Hi,
My logstash configuration is as follows,
input {
file {
start_position => "beginning"
path => "/path/to/json/files*.json"
sincedb_path => "/dev/null"
codec => json
}
}
filter {
split {
field => "[data]"
}
mutate {
add_field => {
"url" => "%{[data][url]}"
"vendorId" => "%{[data][vendorId]}"
"vendor" => "%{[data][vendor]}"
"productId" => "%{[data][productId]}"
"product" => "%{[data][product]}"
"vendor_details" => "%{[data][vendor_details]}"
}
remove_field => [ "[data]" ]
}
}
output {
elasticsearch {
hosts => ["elasticsearch/url"]
index => "test-index"
user => test
password => test333
}
stdout { codec => rubydebug }
}
with the above configuration, the data is being indexed to elasticsearch, but as a message.
"_index" : "test-index",
"_type" : "_doc",
"_id" : "NuQoOngBH1fxUIM9w4b7",
"_score" : 1.0,
"_source" : {
"url" : "%{[data][url]}",
"productId" : "%{[data][productId]}",
"tags" : [
"_jsonparsefailure",
"_split_type_failure"
],
"vendor" : "%{[data][vendor]}",
"@version" : "1",
"vendorId" : "%{[data][vendorId]}",
"product" : "%{[data][product]}",
"message" : "\"vendor_details\": [{\"installCountry\": \"Mexico\", \"installRegion\": \"LATAM\", \"vendorId\": \"476\", \"vendor\": \"General Technology\", \"productId\": \"823\", \"product\": \"Ajax\", \"
Please let me know what am i doing wrong here?