Hello All,
I've a column in oracle table PACKAGE_DATA and it has json like string in it and I would like to get every fileds and its value seperate:
PACKAGE_DATA Column data
{"status":"READY_FOR_PROCESSING","errorData":null,"creationDate":1678096719969,"lastModificationDate":1678096824967,"manyId":"1900","form":"ABC","systemId":"TIS_FULL","userId":"?","XmlFileId":"","size":0,"Kind":"FULL","Datas":[{"serviceRequestId":"29F91450A3","Counter":2,"size":122628,"fileId":"CC2B5","packageId":"1900","lPart":true},{"sRequestId":"190FBB14E1864A75B6B8ECC054FEAD3A","pCounter":1,"size":122628,"fileId":"F6395CF76A2E","packageId":"1900","lastPart":false}],"Histories":[{"status":"START","errorData":null,"creationDate":1678096719980,"lastModificationDate":1678096719980},{"status":"PROCESSING","errorData":null,"creationDate":1678096824974,"lastModificationDate":1678096824974}]}
Expected individual fields in elastic index:
"status":"READY_FOR_PROCESSING",
"errorData":null,
"serviceRequestId":"29F91450A3",
"Counter":2,
"size":122628,
"fileId":"CC2B5".............etc
Tried Filters:
1)With this in logs I can see only sql query statement in log ,but data dont come to index
json {
source => "package_data"
}
filter {
json {source => "package_data"}
split {field => "package_data"}
mutate {remove_field => [ "package_data"]}
}
How should I parse to get seperated fields to be created?
Template:
Template
PUT _index_template/tcs-package-details
{
"template": {
"settings": {
"index": {
"lifecycle": {
"name": "tcs-policy",
"rollover_alias": "tcs-package-details"
},
"number_of_shards": "1",
"number_of_replicas": "0"
}
},
"mappings": {
"_routing": {
"required": false
},
"numeric_detection": false,
"dynamic_date_formats": [
"strict_date_optional_time",
"yyyy/MM/dd HH:mm:ss Z||yyyy/MM/dd Z"
],
"_source": {
"excludes": [],
"includes": [],
"enabled": true
},
"dynamic": true,
"date_detection": true
}
},
"index_patterns": [
"tcs-package-details-*"
],
"composed_of": []
}
Thanx