Hi team,
I have below logstash.conf and json event. Most of the fields are parsed correctly, but for complex array types, it looks like that not parsed as expecte. For example, profile criteria and rating criteria are json object arrays and the actual parsed result is below.
But the expected parsed result is below, and the first level fields (searchOption, keywordCriteria, ratingcriteria or profilecriteria etc.) in body{} is dynamic and could be changed
"body.criteria.type": "text"
"body.criteria.id": "country"
"body.criteria.value": "USA" (here should be parsed as array)
...
"body.ratingCriteria.Criterias": "2018 - 12 - 04", "2018 - 12 - 31" (here should be parsed as array, not string)
**1. logstash configuration **
input {
file{
path => "C:/elkstack/elasticsearch-6.5.1/logs/app.log"
start_position => "beginning"
sincedb_path => "null"
codec => "json"
}
}
2. json event f
"body": {
"Action": "TalentSearch",
"searchOption": [{
"id": "allCriteriaOptional",
"value": ["false"]
}],
"keywordCriteria": {
"searchValue": "",
"bgTypes": ["languages", "specialAssign", "insideWorkExperience", "memberships", "benefitselection", "outsideWorkExperience", "sysScoreCardDevelopmentObjectivesPortlet", "mobility", "documents", "compensation", "tsv2##mdftalentpoolcriteria", "promotability", "leadExperience", "awards", "googledocs", "varPayEmpHistData", "courses", "funcExperience", "education", "fsaelection", "certificates", "community", "preferredNextMove", "tsv2##jobinfo"]
},
"userStatusCriteria": {
"source": [{
"key": "includeInactive",
"value": "true"
}]
},
"profileCriteria": [{
"id": "country",
"type": "text",
"value": ["USA"]
}],
"facetedCriteria": [{
"id": "department",
"elements": [{
"value": "Marketing"
}]
}, {
"id": "division",
"elements": []
}, {
"id": "location",
"elements": []
}],
"ratingCriteria": [{
"id": "sysOverallPotential",
"type": "7",
"name": "Potential - 3x3 Rating",
"item": "null",
"scaleId": "Potential",
"scaleMin": "1",
"scaleMax": "3",
"criterias": [{
"id": "tsv2RatingValidFrom",
"type": "date",
"value": ["2018 - 12 - 04", "2018 - 12 - 31"]
}, {
"id": "tsv2RatingValidTo",
"type": "date",
"value": ["2018 - 12 - 31", "2018 - 12 - 31"]
}, {
"id": "tsv2RatingFromValue",
"type": "prepopulate",
"value": ["1.0"]
}, {
"id": "tsv2RatingEndValue",
"type": "prepopulate",
"value": ["2.0"]
}]
}]
}
}