Hello,
I have a json in the following format.
{"group" : [{"name":"group1","tag":[{"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}]}],"association" : }
Using Logstash config I have to parse tag field and add tags , Hence I have my config filter part as below,
split {
field => "group"
}
mutate{
add_field => {"tag" => "%[group][tag][name]"}
}
But I am getting the result ingested as tag:[group][tag][name].
Kindly suggest where do I have to change my config.
But I dont want to add tags. In my case I want to parse the inner value of the json file.
Like in my case
{"group" : [{"name":"group1","tag":[{"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}]}],"association" : }
When I give,
split {
field => "group"
}
mutate{
add_field => {"tag" => "%[group][tag]"}
}
I am getting the output as tag: {"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}
But when I change that to,
add_field => {"tag" => "%[group][tag][name]"}
I data is getting ingested as tag:[group][tag][name]
it seems you want tag as a separate field as an array which contain ["tag1", "tag2", "tag3"]
if this is your requirement then you can use ruby filter to get such pattern.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.