Log line with multiple JSON Objects

Elastic Stack Logstash
1

Hello, apologies if this has already been asked and answered but I can't seem to find a way to achieve what I'm looking for. I'm using logstash to break down log lines and I have everything separated but I run into a string that has two JSON objects in it.

{
    "topic": "testing",
    "payload": {
        "context": {
            "processed_event_name": "TRANSACTION_CREATED",
            "processed_event_context": {
                "transaction_id": 139597215,
                "type_of_transaction": 1
            }
        },
        "eventName": "MESSAGE_PROCESSED",
        "correlationId": "954625b4-1307-4298-b206-c0949613f603",
        "timestamp": "2019-04-12T13:01:35-07:00"
    }
}
{
    "correlationId": "954625b4-1307-4298-b206-c0949613f603",
    "eventId": "TRANSACTION_CREATED",
    "hostname": "ccabrals-MacBook-Pro.local"
}

Running this on the above string results in the second JSON object being parsed into top level key value pairs in the output

 json {
    source => "json"
    target => "[json_object]"
  }

But I can't match the first nested JSON Object.

My desired output would be something like this:

nested_json_object: {
       nested_key_value_pairs: {
         key:value
      }
},
json_object: {
  key: value,
}

Any help would be appreciated, thanks.

2

You need to split it into two fields. That may be simple, or may involve some complicated ruby code.

3

Perfect, thank you, that works.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.