Logstash json restructuring

Elastic Stack Logstash
1

I have a structure like
{
f1: 12,
f2 : {
nf1: {........}
}
}

I want to convert it to { f1:12, nf1: {......} }

When I try add_field { "nf1"=> "[f2][nf1]" }, the RHS is not evaluated. If I use %{}, the value is stringified JSON. I also tried adding field nf1 and then copying value-

add_field => { "nf1" => {}}
copy => { "[f2][nf1]" => "nf1" }

But this also does not work. How to do it ?

2

Have you tried using a mutate filter to rename [f2][nf1] to nf1?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.