Kv parse

Elastic Stack Logstash
1

Sample

{"Time": "2018-05-10", "Server": {"Name": " Default , "id" : " 521"}}

When i parse using kv with : and , i am getting time field right but not the name. I am gerting server: Name: Default but i just require Name: Default. Or something of getting [server][name] = default

2

That is JSON, so why are you not using the json filter instead?

3

Yes i can. Let us say i have about 15fields. I only require five fields then i would have to apply remove_field for the rest 10 fields. Is there a shorter way? Any other plugin just to display the required field

4

What is wrong with using the json filter and then removing the additional fields, especially if this is easier and potentially also more efficient?

5

sure. trying to find a better way.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.