Input message looks like below
{
"records": [
{
"level": "Informational",
"properties": {
"Keywords": 0,
"ProviderName": "Core.LogRecord",
"Message": "2022-09-08 08:17:02,935 [23] INFO {"Message":"9/8/2022 8:17:02 AM - StarhubAuthTokenFunc - Identifier => 0 CanRefreshToken = False","Exception":null,"Environment":"NANANA","Server":"XXXXXX","ContextType":"Message","CorrelationId":null,"ApplicationName":"Microsoft.Azure.WebJobs.Script.WebHost","ApplicationVersion":"2.0.0.0","Data":""}"
},
"time": "2022-09-08T08:17:02.9358854+00:00"
}
]
}
Output:
all tags should be able to see in kibana as key and associated value
Can I get any help in this regard .
leandrojmp
(Leandro Pereira)
September 22, 2022, 11:51am
2
What are you trying to do? What is not working? And what is the expected result?
You need to provide more information.
Thanks Leandro for response,
logstash filter I'm using is as below
filter{
json {
source => "message"
remove_field => ["message"]
}
split {
field => "records"
}
ruby {
code => '
records_size = event.get("[records]").size
records_size.times do |index|
event.set("[records][#{index}][properties][Message]", event.get("[records][#{index}][Message]"))
end
'
}
date {
match => [ "time", "ISO8601" ]
}
mutate {
add_field => { "feed_site" => "netherlands" }
add_field => { "feed_name" => "teleena" }
add_field => { "feed_type" => "logs" }
add_field => { "feed_doc" => "afandsf-eventhub" }
}
}
Output is like this but requirement is it should show all the key-values including inside the Message
Please suggest filter for it