Logstash filter config to parse JSON

Elastic Stack Logstash
1

I tried to parse json input file. But logstash doesn't parse the logs and not adding custom field "add_field". I think, my filter configuration is wrong. Someone please help me on this.

Logs file:

{"web1":{"stat1":{"mem":261831,"Name":"stat1","cpu":89}},"web2":{"stat2":{"mem":23456,"Name":"stat2","cpu":76}}}

Logstash filter config:

filter {
    if [type] == "localapp" {
	  if [Name] { 
		date {
				target => "@timestamp"
        	   		locale => "en"
		       	        add_field => { "testapp" => "%{Name}"}
                        } 
		}
	}
 }

Output:

{
          "web1" => {
        "stat1" => {
             "mem" => 261831,
            "Name" => "stat1",
             "cpu" => 89
        }
    },
          "web2" => {
        "stat2" => {
             "mem" => 23456,
            "Name" => "stat2",
             "cpu" => 76
        }
    },
      "@version" => "1",
    "@timestamp" => "2016-06-20T05:52:25.002Z",
          "type" => "localapp",
          "host" => "gugan"
}

Here you can see custom field is not added.

2

Your JSON parses just fine.

However, your date filter doesn't contain a match option that specifies which field to parse and how it should be parsed. What are you trying to do here?

3

Thanks for your reply.
I done some correction and adding timestamp into the custom json value.

Log:
{"web1":{"Name":"web1","stats":{"mem": 261831,"cpu":89,"timestamp":"2016-06-20 05:32:03"}}}

Logstash Filter:

filter {
    if [type] == "localapp" {
	  if [Name] { 
		date {
				match => ["timestamp", "YYYY-MM-dd HH:mm:ss"]
				target => "@timestamp"
       		   		locale => "en"
		       	        add_field => { "testapp" => "%{Name}"}
                        } 
		}
	}
 }

Expecting output:
1.) Use timestamp value what present on log message .
2.) Adding custom field for using it to creating separate document type per servers.

Above both conditions are not working . Please help.

4

Your fields aren't named Name and timestamp, they're named [web1][Name] and [web1][stats][timestamp].