Map JSON from Cloudflare

Hi there,
I pull API data from Cloudflare through the http_poller_plugin from Logstash to Elasticsearch. That works fine. Except for the JSON response and the regarding mapping in Elasticsearch. I am going to understand a bit how the entire Elastic ecosystem works and would be glad about help from you guys. The JSON data I passthrough to Elasticsearch is not well automatically mapped. A response from Cloudflare looks like this:

"success": true,
"query": {
    "since": "2019-05-29T00:00:00Z",
    "until": "2019-06-05T00:00:00Z",
    "time_delta": 1440
"errors": [],
"messages": [],
"result": {
    "timeseries": [
            "bandwidth": {
                "all": 56027939,
                "cached": 2864649,
                "content_type": {
                    "empty": 11575,

You may see, the interesting data starting in the "result" property. Can I isolate it in any kind, to just get everything within "timeseries"? The entire mapping looks like this at the moment, which is hardly to work further with:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.