Keep hierarchy in json data

Elastic Stack Logstash
1

Hi All.

I try to parse the hierarchical json data.
Problem is there are same field in different level like below.
{"id":"TEST","level2":{"id":"Level2 id"}}

In above case, final appeared id is overwrite previous one and it looks basic behavior of json filter.

Is there any workaround to keep json hierarchy like below ?
id : TEST
level2.id : Level2 id

Thanks
Ducheol

2

{"id":"TEST",{"id","Level2"}}

But... this isn't valid JSON.

3

Sorry, I just updated my original document.

{"id":"TEST","level2":{"id":"Level2 id"}}

Above is valid json.

4

Yes. But I don't know what overwriting you're talking about. Logstash handles that JSON snippet as I'd expect it to:

$ cat test.config 
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
  json {
    source => "message"
  }
}
$ echo '{"id":"TEST","level2":{"id":"Level2 id"}}' | /opt/logstash/bin/logstash -f test.config
Logstash startup completed
{
       "message" => "{\"id\":\"TEST\",\"level2\":{\"id\":\"Level2 id\"}}",
      "@version" => "1",
    "@timestamp" => "2015-10-09T05:28:36.484Z",
          "host" => "lnxolofon",
            "id" => "TEST",
        "level2" => {
        "id" => "Level2 id"
    }
}
Logstash shutdown completed
5

You're right. In the logstash log, it show as hierarchical.

But in the ES, only 'Level2 id' is shown under id field and 'TEST' which is id value in parent is gone.

https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html
In above, I see below sentence
By default it will place the parsed JSON in the root (top level) of the Logstash event, but this filter can be configured to place the JSON into any arbitrary event field, using the target configuration.

I'm not sure. But I think same element is appeared, previous data is overwritten by last one.
If the json filter named the field hierarchically, then I think it could be resolved.

Thanks
Ducheol