Keys_under_root option in configuration

[krhubert]

Hi,

Just wonder how to put keys_under_root like filebeat do in my own beat? Is this supported or documented somewhere?

[andrewkroh]

Can you provide more details about what you want to accomplish.

[krhubert]

Sure,

The filebeat has such option:

keys_under_root
By default, the decoded JSON is placed under a "json" key in the output document. If you enable this setting, the keys are copied top level in the output document. The default is false.

What do I want to do?

I'm writing simple go program that processes documents that have a lot of string/double values and it's flat. I'm using elastic library to get the search results and every document data is stored under _source field and I have to parse the document every time. It would be easier to just get value by typing document.Field["key"].(string), and I was wonder from curiosity if how to accomplish putting keys under root in libbeat.

[andrewkroh]

So if you are writing a Beat you are creating the output event that will be published. When you create the event you can populate it with the contents of the _source field.

I think you will have to unmarshal the _source field into a map[string]interface{}. Then once you have the _source field as an object you and create your event and populate it with the contents of _source.

source := // unmarshal _source JSON to map
myEvent := common.MapStr{
    "@timestamp": common.Time(time.Now()),
    "type": "mytype",
}
for k, v := range source {
    myEvent[k] = v
}