Logstash get field from elasticsearch message


I have this message on ElasticSearch
"_index": "audit_201712",
"_type": "ccc",
"_id": "AWAsoVnydQqBAYNwSrNi",
"_score": null,
"_source": {
"resourceType": "AuditEvent",
"id": "4306b213-65a2-4ae1-b7e6-d1221fac321a",
"type": {
"system": "http://hl7.org/fhir/audit-event-type",
"code": "rest",
"display": "RESTful Operation"
"outcome": "2",
"outcomeDesc": "Accepted",
"agent": [
"role": [
"coding": [
"system": "http://hl7.org/fhir/v3/ParticipationType",
"code": "AUT",
"display": "author (originator)"

Im using logstash to get data from ElasticSearch and save data (using logstash-output-jdbc) on mysql.
How can i, using logstash, get for example the field in _source.outcome or _source.agent[0].name?

If you use an elasticsearch input the whole contents of _source will be available to filters and outputs. Without specifics on what you want to do I can't give a more specific answer.

thank you.
i just want get the value of specific fields to add them on mysql insert statement... but I was not getting the value of the fields, because i didnt know the syntax ...


thank you...
i'm gonna try this :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.