Logstash parsing in JSON

[Sivajanani]

Hello,
I have a json in the following format.
{"group" : [{"name":"group1","tag":[{"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}]}],"association" : }
Using Logstash config I have to parse tag field and add tags , Hence I have my config filter part as below,

split {
field => "group"
}
mutate{
add_field => {"tag" => "%[group][tag][name]"}
}
But I am getting the result ingested as tag:[group][tag][name].

Kindly suggest where do I have to change my config.

[grumo35]

Hi,

add_tag => [ "%{[group][tag][name]}"]

Should do the trick

[Sivajanani]

Hi @grumo35,
Thanks for the reply.

I have tried this. It is adding tags. Instead I want data to be ingested as,
tag [0]: tag1
tag [1]: tag2 and so on

where tag1,tag2,tag are part of json which has the above format mentioned in the case raised.

[Sivajanani]

To add up, after changing
add_tag => [ "%{[group][tag][name]}"]

the result is as below,
tags" => [
[0] "["tag", "%{[group][tag][name]}"]"

[grumo35]

I'm not sure to fully understand your use case but you might wan to iterate over results in ruby to match the tag array position you want to use.

Did you manage to get it work ?

[Sivajanani]

No still I am trying.

[grumo35]

Logstash::Event and Ruby code for dynamic tags with Logstash 2.3.4

Hi. I use Logstash 2.3.4 to read events from Kafka broker and have a problem with the filtering. I am trying to flatten the uniq_log_name1 object and turn uniq_log_name1 into a tag. My problem is not knowing what dynamic variable is available within the Ruby code interpreter after Kafka decodes the event as JSON. My testing works fine on the command-line but when using the Kafka input it fails because of the JSON decoding. I know this by testing with json codec on stdin and by disabling jso…

[Sivajanani]

But I dont want to add tags. In my case I want to parse the inner value of the json file.

Like in my case
{"group" : [{"name":"group1","tag":[{"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}]}],"association" : }
When I give,
split {
field => "group"
}
mutate{
add_field => {"tag" => "%[group][tag]"}
}
I am getting the output as tag: {"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}

But when I change that to,
add_field => {"tag" => "%[group][tag][name]"}
I data is getting ingested as tag:[group][tag][name]

[chitreshg (Chitresh Gargwanshi)]

it seems you want tag as a separate field as an array which contain ["tag1", "tag2", "tag3"]
if this is your requirement then you can use ruby filter to get such pattern.

[Badger]

Why are you using split when there is only a single member in the [group] array? You could just use

mutate { add_field => { "group" => "%{[group][0]}" } }

For the example data in the first post what do you want the final event to look like?

[Sivajanani]

Thank you all for the suggestion.

I could get a single tag by giving like below,
"tag1" => "%{[group][tag][0][name]}"

[Badger]

Does that mean your problem is solved? If not, what do you want the event fields to look like?