More JSON Fun

Elastic Stack Logstash
1

I have managed to get some JSON into a target field in this manner: json { source => dataMsg target => justJSON }. I do not know how to access the field data to convert certain fields to floats or integers for use in Kibana. I am posting some of the data for reference. Shown below is a redacted out from rubydebug-

"justJSON" => [
[0] {
"dst_region" => "Washington",
"file_path" => "",
"cci" => 90,
"scan_type" => "Ongoing",
"type" => "nspolicy",
"_session_begin" => 1,
"ccl" => "excellent",
"dst_longitude" => -122.1205978394,
"dst_latitude" => 47.6800994873,
snip snip snip
I have tried various combinations of formats with no success . I have pasted my last attempt.
convert => {"[justJSON][src_latitude]" => "float"}
convert => {"[justJSON][dst_latitude]" => "float"}
convert => {"[justJSON][src_longitude]" => "float"}
convert => {"[justJSON][dst_longitude]" => "float"}

add_field => { "src_geo_location" => "[justJSON][src_latitude],[justJSON][src_longitude]" }
add_field => { "dst_geo_location" => "[justJSON][dst_latitude],[justJSON][dst_longitude]" }

What is the correct way to access the field data?

2

The problem is that the justJSON field is an array. You'll probably want to move the subfields of [justJSON][0] into the top level. You can probably do that with a mutate filter's rename option but then you need to enumerate all fields yourself. If the list of interesting fields is dynamic you'll have to ues a ruby filter.

convert => {"[justJSON][src_latitude]" => "float"}
convert => {"[justJSON][dst_latitude]" => "float"}
convert => {"[justJSON][src_longitude]" => "float"}
convert => {"[justJSON][dst_longitude]" => "float"}

Okay, but judging by what you posted at least the dst fields are floats.

add_field => { "src_geo_location" => "[justJSON][src_latitude],[justJSON][src_longitude]" }
add_field => { "dst_geo_location" => "[justJSON][dst_latitude],[justJSON][dst_longitude]" }

You need to use the %{fieldname} notation and since justJSON is an array the correct way to address the fields would be [justJSON][0][src_latitude].

3

Excellent, Thanks. I really need to get training on this..

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.