Logstash csv configuration to access nested json field

Elastic Stack Logstash
1

Following is my logstash configuration to load es data and convert to csv format

input {
elasticsearch {
hosts => "localhost:9200"
index => "chats"
query => '{ "query": { "range" : {
"timestamp" : {
"gte" : "1492080665000",
"lt" : "1492088665000"
}
} }, "_source": [ "timestamp","content.text"] }'
}
}

filter {
date {
match => [ "timestamp","UNIX_MS" ]
target => "timestamp_new"
remove_field => [ "timestamp" ]
}
csv {
columns => ["timestamp", "content.text"]
separator => ","
}
}

output{
csv {
fields => ["timestamp_new","content.text"]
path => "/home/ubuntu/chats-content-date-range-v3.csv"
}
stdout { codec => rubydebug }
}

Sample input data

"_source":{"userName": "xxx", "senderType": 3, "spam": 0, "senderId": "1000", "threadId": 101, "userId": "xxx", "sessionId": 115, "content": {"text": "Yes okay", "image": null, "location": null, "card": null}, "receiverId": "xxx", "timestamp": 1453353242657, "type": 0, "id": "0dce30dd-781e-4a42-b230-a988b68fd9ed_1000_1453353242657"}

Following is my sample output data

2017-04-13T12:41:34.423Z,"{""text"":""Yes okay""}"

Instead I want following output

2017-04-13T12:41:34.423Z,"Yes okay"

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.