Json Target doesn't work

Elastic Stack Logstash
1

Hello,

I am using logstash 7.3.1.

I use an http input plugin to get data into logstash. I get an JSON payload which looks like

{"version":"1.1","host":"myHost","short_message":"Test Dev","full_message":"Testlog Message for Elastic","level":1,"_server_name":"localhost","_server_ip":"127.0.0.1","_server_apppool":"FSCPool","_user_id":"xx\\yyyy","_coo_env":"123456","_level_name":"INFO","_url_args":"&cx=Y52EHGmnn-PiUVV2&tz=-60&xhr=1"}

Based on the attribute "host" in the Json I have to do some logic, the problem seems that the input plugin already provides a field named "host".
In case I use the json plugin as followed, the information from the input json (except the host attribute) is available. The host field still contains the value from the http input.

json {
		source => "message"
     }

I came accross the target parameter in the json plugin
json {
source => "message"
target => "parsed_json"
}

As it is indicated in the documentation the parsed information should not be placed in the root but in the "parsed_json".
Basically the json is parsed correctly (except the host) but all information are placed in the root and not in "parsed_json"

Is there something I have overlooked or did I missunderstood something?

Beside the issue with the target - is there another solution for my duplicate host problem?
I also tried to remove, rename,... the host field from the input but nothing changed.

Thanks in advance for your help
Regards

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.