Logstash - Json file input question

You can read the entire file as a single event using a multiline codec as described here.

Then use a json filter with the target option set to parse the file contents. It will parse nested fields just fine,

Then use a split filter to split the array into multiple events.

Then use a prune filter with a whitelist to discard everything except _source.

Then use a ruby filter as described in the link at the end of that post I linked to move the contents of _source to the top level.

1 Like