Logstash parse JSON into individual events

Hi,
Im trying an HTTP Poller which returns me the response in the below format:

{"term":"hamma","suggestions":{"cities":[{"id":101509,"name":"Hammaliya","type":"city","region":"Sri Lanka","country":"Sri Lanka"},{"id":81633,"name":"Hammam Chott","type":"city","region":"North Coast","country":"Tunisia"},{"id":93911,"name":"Hammam Sousse","type":"city","region":"Sousse","country":"Tunisia"},{"id":902,"name":"Hammamet","type":"city","region":"","country":"Tunisia"},{"id":8289,"name":"Hammamet-Yasmine","type":"city","region":"Hammamet","country":"Tunisia"},{"id":69291,"name":"Hammana","type":"city","region":"Lebanon","country":"Lebanon"},{"id":57088,"name":"Hammanskraal","type":"city","region":"Johannesburg & surrounding area","country":"South Africa"},{"id":63037,"name":"Hammar","type":"city","region":"Svealand","country":"Sweden"},{"id":106862,"name":"Hammarland","type":"city","region":"Aland Islands","country":"Finland"},{"id":82810,"name":"Hammarö","type":"city","region":"Svealand","country":"Sweden"},{"id":55589,"name":"Hammarstrand","type":"city","region":"Norrland","country":"Sweden"}],"properties":}}

The requirement for me is to store each of the citiesitem (array element) as a separate event in the elastic search. To be specific , I want to extract the term ,id, name, type,region,country and properties for each record and pass this individual event to the ElasticSearch output plugin.

Can you help on this?

my logstash file conf:
input {
http_poller {
urls => {
url => "XXX"
}
request_timeout => 60
schedule => { every => "60s" }
codec => "json"
}
}
filter {
json {
source => "term"
}
}
output {
elasticsearch {
hosts => "localhost:9200"
index => "test"
}
stdout { codec => rubydebug }
}

what does you stdout output looks like ?

Try

split { field => "[suggestions][cities]" }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.