Logstash json parsing

Elastic Stack Logstash
1

Hello. I have incoming JSON log. It has nested JSON. I want to parse main JSON and nested. Example:

{
"value":  "123",
"nested": {
     "value-two": "555"
  }
}

.

I have a filter like this

json {
   source => "message"
   target => "json"
}
json {
  source => ??? (string type)
}

how can I set [json][value-two] if i must to pass string?

2

I am not sure what you are trying to do. But here is an example.

Conf

input {
   generator {
     lines => [
          '{
      "value":  "123",
      "nested": {
          "value-two": "555"
        }
      }' 
     ]
     count => 1
     codec => json
   } 
}
filter {

    json { source => "message"}

    mutate {
      convert => {
        "[nested][value-two]" => "integer"
      }
    }

}
output {
  stdout { codec =>  json_lines }
}

Returns

{
	"value": "123",
	"host": "Aarons-MBP.domain",
	"sequence": 0,
	"nested": {
		"value-two": 555
	},
	"@version": "1",
	"@timestamp": "2021-04-21T13:58:21.167Z"
}

If that doesn't help can you reply on what you are looking to do exactly?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.