Dear Ashish,
Thank you a lot for your support. Your solution works to import data. However, I forgot to say my requirement clearly. I already have an index with the mentioned field and want to map input JSON into the appropriate field. Please find the existing structure/data and newly inserted record from logstash.
Is there any way to make json fields to index fields rather than getting it as "parsed_json" or "json_content" . Also want to know is it possible in nested table as well.
-- structure
{
"my_index": {
"aliases": {},
"mappings": {
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"age": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"city": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"user1": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"userid": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
}
-- data
"hits": [
{
"_index": "my_index",
"_id": "6iXxNJIBnBMzydZlUOYX",
"_score": 1.0,
"_source": {
"userid": "1001",
"user1": "sam",
"city": "tornto",
"@timestamp": "2024-09-27T19:24:42.590670979Z",
"@version": "1",
"age": "32"
}
},
-- newly inserted data via logstash json
{
"_index": "my_index",
"_id": "1005",
"_score": 1.0,
"_source": {
"parsed_json": {
"user": "Eve",
"city": "Paris",
"age": "25"
},
"json_content": "{"user": "Eve", "age": "25", "city": "Paris"}",
"@version": "1",
"@timestamp": "2024-09-27T19:36:13.840690324Z"
}
}
thanks in advance once again.