Logstash get field from elasticsearch message

Elastic Stack Logstash
1

Hi,

I have this message on ElasticSearch
{
"_index": "audit_201712",
"_type": "ccc",
"_id": "AWAsoVnydQqBAYNwSrNi",
"_score": null,
"_source": {
"resourceType": "AuditEvent",
"id": "4306b213-65a2-4ae1-b7e6-d1221fac321a",
"type": {
"system": "http://hl7.org/fhir/audit-event-type",
"code": "rest",
"display": "RESTful Operation"
},
"outcome": "2",
"outcomeDesc": "Accepted",
"agent": [
{
"name":"test"
"role": [
{
"coding": [
{
"system": "http://hl7.org/fhir/v3/ParticipationType",
"code": "AUT",
"display": "author (originator)"
}
]
}
]
]
}

Im using logstash to get data from ElasticSearch and save data (using logstash-output-jdbc) on mysql.
How can i, using logstash, get for example the field in _source.outcome or _source.agent[0].name?

2

If you use an elasticsearch input the whole contents of _source will be available to filters and outputs. Without specifics on what you want to do I can't give a more specific answer.

3

thank you.
i just want get the value of specific fields to add them on mysql insert statement... but I was not getting the value of the fields, because i didnt know the syntax ...

4

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references

5

thank you...
i'm gonna try this :slight_smile:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.