Logstash is replacing : with => How can I get : on the output

[harshbajaj16 (Harsh Bajaj)]

Hi @Raj_Sekhar,

You need to add this in your logstash configuration file which is in /conf.d/ directory.

There are three section in conf file Input, Filter and Output. You need to add this in filter section.

Please find document link for filter ruby plugin.

Ruby filter plugin | Logstash Reference [8.11] | Elastic

Also, i found a discussion for similar problem. You can look into this and can get more idea about filter plugin.

JSON parsing problem

Hi there! My target is very simple (as it seems): I want logstash to receive a json from http, process this json with some scrypt, and bypass it as json next. I've started with json codec, but I've not found any way to properly access the root of event object, so I could not get the whole json content. So, I saw this How to read JSON input sent to Http input plugin in filter section topic and tried to make config like in the answer. Let's say I've this config now: input { http { id => …

File in the command is /tmp/test.json.

Please do let me know if you need more help in this regard.

Regards,
Harsh Bajaj