Hi... i'm having issue with parsing of multiple nested JSON can any1 help..
I just dont want identify key field..
JSON Format
{
"billingDetails": {
"POSBILL": [
{
"BillId": 49,
"BillNo": "POS/16Oct18",
"BillDate": "2018-10-12T17:29:03.053",
"TerminalId": "2",
"customerId": "",
"cardNo": "",
"StockPointId": "1",
"DiscountId": "",
"MRPAmt": "2000.00",
"BasicAmt": "2000.00",
"PromoAmt": "0",
"SaleAmt": "2000.00",
"ReturnAmt": "0",
"GrossAmt": "2000.00",
"LPDiscountAmt": "0",
"discountBenefitId": "",
"pointBenefit": "",
"DiscountAmt": "0.00",
"NetAmt": "2000.00",
"ChargeAmt": "0",
"NetPayable": "2000",
"RoundOff": "0",
"ExTaxAmt": "0",
"PromoCode": "",
"PromoBenefit": "",
"BillGUID": "3-2-121018172710",
"MDiscountAmt": "0",
"EMRREDCouponRef": "",
"CouponCode": ""
}
],
"POSBillItems": [
{
"POSBillItemId": 170,
"ItemId": "T1036",
"BarCode": "1",
"ItemName": "SKIRT",
"Division": "Gents",
"Section": "Upper",
"Department": "Shirt",
"Article": "GENTS-UPPER-SHIRT",
"Qty": 1,
"RtQty": 0,
"MRP": 1000,
"RSP": 1000,
"ESP": 1000,
"MRPAmt": 1000,
"BasicAmt": 1000,
"PromoAmt": 0,
"GrossAmt": 1000,
"IDiscountDisplay": null,
"IDiscountAmt": 0,
"SalePrice": 1000,
"IGrossAmt": 1000,
"MDiscountAmt": 0,
"DiscountAmt": 0,
"NetAmt": 1000,
"TaxPercent": 5,
"TaxAmt": 47.62,
"TaxableAmt": 952.38,
"IDiscountFactor": 0,
"MDiscountFactor": 0,
"PromoCode": null,
"PromoDiscountFactor": null,
"RefPOSBillItemId": null,
"LPDiscountBenefit": null,
"LPPointBenefit": null,
"MGrossAmt": 1000,
"LPDiscountAmt": null,
"LPAmountSpendFactor": null,
"LPPointEarnedFactor": null,
"LPPointsCalculated": 0,
"LPDiscountFactor": null,
"RefBillNo": null
},
{
"POSBillItemId": 171,
"ItemId": "T1036",
"BarCode": "1",
"ItemName": "SKIRT",
"Division": "Gents",
"Section": "Upper",
"Department": "Shirt",
"Article": "GENTS-UPPER-SHIRT",
"Qty": 1,
"RtQty": 0,
"MRP": 1000,
"RSP": 1000,
"ESP": 1000,
"MRPAmt": 1000,
"BasicAmt": 1000,
"PromoAmt": 0,
"GrossAmt": 1000,
"IDiscountDisplay": null,
"IDiscountAmt": 0,
"SalePrice": 1000,
"IGrossAmt": 1000,
"MDiscountAmt": 0,
"DiscountAmt": 0,
"NetAmt": 1000,
"TaxPercent": 5,
"TaxAmt": 47.62,
"TaxableAmt": 952.38,
"IDiscountFactor": 0,
"MDiscountFactor": 0,
"PromoCode": null,
"PromoDiscountFactor": null,
"RefPOSBillItemId": null,
"LPDiscountBenefit": null,
"LPPointBenefit": null,
"MGrossAmt": 1000,
"LPDiscountAmt": null,
"LPAmountSpendFactor": null,
"LPPointEarnedFactor": null,
"LPPointsCalculated": 0,
"LPDiscountFactor": null,
"RefBillNo": null
}
],
"POSBillMOP": [
{
"POSBillMOPId": 93,
"MOPId": "112",
"MOPName": "Cash",
"MOPType": "CSH",
"CurrencyId": "1",
"BaseTender": 2000,
"BaseBalance": 0,
"BaseAmt": 2000,
"Tender": 2000,
"CCNo": null
}
],
"POSCustomer": []
},
"membershipId": null,
"BillEvent": "NEW",
"event": "addTransaction",
"apiTypeResolver": "api",
"providerCode": "LPCAP",
"metadata": {
"enterpriseMetadata": {
"enterpriseId": "5a3229d5ccbc37c3449a4890",
"cluster": "api.capillary.co.in",
"apiversion": "v1.1",
"pointredemptionview_otpvalidation": "0",
"couponredemptionview_otpvalidation": "0"
},
"storeMetadata": {
"password": "and123",
"username": "and.ho1",
"storeCode": "3"
},
"requestMetadata": {
"requestUid": "c7bdad7e-3361-41a3-8ff6-d9db93b414b2",
"mqReferenceNo": "8c7c54e9-f428-4761-9c65-f6bb86f5df3a"
}
}
}
My conf file...
input {
s3 {
access_key_id => ""
secret_access_key => ""
region => ""
bucket => ""
interval => 30
additional_settings => {
force_path_style => true
follow_redirects => false
}
codec => multiline {
pattern => "^\s"
what => "previous"
}
}
}
filter {
grok {
match => {"message" => "%{TIME:Time}%{SPACE}[%{DATA:thread}]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}%{JAVACLASS:log-class}%{SPACE}-%{SPACE}%{DATA:requestType}%{SPACE}{%{QS:id}:%{NUMBER:id},(?:.):%{QS:requestId},(?:.):%{QS:messageReferenceNo},(?:.):%{QS:retailModule},(?:.):%{QS:event},(?:.):%{QS:enterpriseId},(?:.):%{QS:storeId},(?:.*):%{QS:requestData},%{QS:requestTime}:%{NUMBER:requestTime},%{QS:auditAction}:%{NUMBER:auditAction}}"}
match => {"message" => "%{TIME:Time}%{SPACE}\[%{DATA:thread}]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}%{JAVACLASS:log-class}%{SPACE}-%{SPACE}%{GREEDYDATA:details}"}
}
}
filter {
mutate {
gsub => [ "requestData", '\"', '"' ]
}
}
filter {
json {
source => "requestData"
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "s3-bucket"
}
stdout {
codec => rubydebug
}
}
Please help...