Merge multiple fields in document into json array

[mussa572 (Musa)]

Hi,

I have following document Ingesting into Elasticsearch using the logstash

    _source": {
           "server_name": "abc",
           "server_ip": "0.0.0.0",
           "server_location: "us"
           "type" :  "laptop"
         }

I am looking to use logstash to convert the document fields into json object similar to following output for all the fields related to server . I would appreciate if someone can please point the right direction to find the right solution

    _source": {
          "server { 
             "name" : "abc",
             "ip": "0.0.0.0",
             "location": "us"
                }
          type:  laptop

[aaron-nimocks]

Not sure if your data source actually has _source or not. But this should give you an idea.

Config

filter {
  mutate {
    rename => { "server_name" => "[server][name]" }
    rename => { "server_ip" => "[server][ip]" }
    rename => { "server_location" => "[server][location]" }
  }
}

Output

{
    "server": {
        "name": "abc",
        "ip": "0.0.0.0",
        "location": "us"
    },
    "type": "laptop"
}

[mussa572 (Musa)]

Thanks Aaron , Worked as expected