Logstash JSON Filter Error

Elastic Stack Logstash
1

I've pulled data from a SQL database that gets put into a field like below.

    "assignment": [
      {
        "assignedto": "1234",
        "assignedtoname": "John Doe",
        "assignedgroupid": 1
      }
    ]

I'm using the following JSON config in my pipeline.

  if [assignment] {
    json {
      source => "[assignment][0]"
      target => "assigned"
    }
  }

This results in the following error. What am I doing wrong?

[WARN ][logstash.filters.json    ] Error parsing json {:source=>"[assignment][0]", :raw=>{"assignedto"=>1234, "assignedtoname"=>"John Doe", "assignedgroupid"=>1}, :exception=>#<Java::JavaLang::ClassCastException: >}
2

Note that the :raw value has "assignedto"=>1234, not "assignedto": "1234". So [assignment][0] is a hash, not a string. I would guess you have a JSON column in the DB and the jdbc input parsed it for you.

3

Does the raw value include the {}?

{
  "assignedto"=>1234,
  "assignedtoname"=>"John Doe",
  "assignedgroupid"=>1
}

or

"assignedto"=>1234,
"assignedtoname"=>"John Doe",
"assignedgroupid"=>1