Logstash parsing in JSON

Elastic Stack Logstash
#1

Hello,
I have a json in the following format.
{"group" : [{"name":"group1","tag":[{"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}]}],"association" : }
Using Logstash config I have to parse tag field and add tags , Hence I have my config filter part as below,

split {
field => "group"
}
mutate{
add_field => {"tag" => "%[group][tag][name]"}
}
But I am getting the result ingested as tag:[group][tag][name].

Kindly suggest where do I have to change my config.

#2

Hi,

add_tag => [ "%{[group][tag][name]}"]

Should do the trick

#3

Hi @grumo35,
Thanks for the reply.

I have tried this. It is adding tags. Instead I want data to be ingested as,
tag [0]: tag1
tag [1]: tag2 and so on

where tag1,tag2,tag are part of json which has the above format mentioned in the case raised.

#4

To add up, after changing
add_tag => [ "%{[group][tag][name]}"]

the result is as below,
tags" => [
[0] "["tag", "%{[group][tag][name]}"]"

#5

I'm not sure to fully understand your use case but you might wan to iterate over results in ruby to match the tag array position you want to use.

Did you manage to get it work ?

#6

No still I am trying.

#7
#8

But I dont want to add tags. In my case I want to parse the inner value of the json file.

Like in my case
{"group" : [{"name":"group1","tag":[{"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}]}],"association" : }
When I give,
split {
field => "group"
}
mutate{
add_field => {"tag" => "%[group][tag]"}
}
I am getting the output as tag: {"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}

But when I change that to,
add_field => {"tag" => "%[group][tag][name]"}
I data is getting ingested as tag:[group][tag][name]

#9

it seems you want tag as a separate field as an array which contain ["tag1", "tag2", "tag3"]
if this is your requirement then you can use ruby filter to get such pattern.

#10

Why are you using split when there is only a single member in the [group] array? You could just use

mutate { add_field => { "group" => "%{[group][0]}" } }

For the example data in the first post what do you want the final event to look like?

#11

Thank you all for the suggestion.

I could get a single tag by giving like below,
"tag1" => "%{[group][tag][0][name]}"

#12

Does that mean your problem is solved? If not, what do you want the event fields to look like?