Logstash split the child json to the parent layer

Elastic Stack Logstash
1

this is json

{
    "@timestamp" => 2022-11-19T06:19:08.249Z,
      "database" => "12",
     "data": {
     "a": 1,
     "b": 2
}
}

how resolve to

{
    "@timestamp" => 2022-11-19T06:19:08.249Z,
      "database" => "12",
     "a": 1,
     "b": 2
}
2

You could use something like the last ruby filter in this post.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.