Hello Community Users,
I am seeking help regarding writing a better logstash configuration file.
I am dealing with nested array JSON which looks something like this.
{
"data": {
"content": {
"payload": [
{
"a": "John",
"b": "Doe",
"c": 23
},
{
"b": "Mary",
"c": "Smith"
}
]
}
}
}
And to parse this JSON, I am writing if conditions in the JSON filter I am using in my logstash configuration file.
filter{
if[data][content][payload][0]{
mutate {
add_field => {
"dataContext0" => '%{[data][content][payload]}%'
}
}
}
if[data][content][payload][1]{
mutate {
add_field => {
"dataContext1" => '%{[data][content][payload]}%'
}
}
}
}
This code snippet works absolutely fine. The only problem is, I might have a thousand nested fields in the future in the JSON, and parsing like this would create a very ugly-looking configuration file as there will be a thousand number of if conditions I will have to add before adding them in mutating fields.
I wanted to know, Is there any better way to deal with this which can reduce these if conditions or eliminate them at all with a better alternative.
Please help me here if you know something or have gone through a scenario like this.
Thanks in advance.