Multiple Root Element in single line

Elastic Stack Logstash
1

I need help with splitting multiple root element in single line.
My data format like this,

b_rooms_available_and_soldout:[{"b_id":123, "b_blocks":[{...}]},{"b_id":456, "b_blocks":[{...}]}]

My logstash config is,

    filter {

     mutate {
        gsub => [
          "message", '^b_rooms_available_and_soldout:.', '',
          "message", "],$", "",
          "message", " ", ""
          ]
      }

      json {
        source => "message"
        #target => "event"
      }

      split {
        field => "b_blocks"
      }
}

It successfully parsing and splitting if there is only one element, but if there is multiple elements it fails. how do i separate them?

2

Can you try something like this:

...

json {
    source => "message"
    target => "event"
}

split {
    field => "event"
}

split {
    field => "[event][b_blocks]"
}
3

I ran it,
I am getting parse error and split error,

:exception=>#<LogStash::Json::ParserError: Unexpected character (',' (code 44)): expected a value
 at [Source: (byte[])"{"b_id":50699001,"b_roomtype_id":9,"b_has_room_inventory":1,"b_name":"DeluxeDoubleRoom","b_blocks":[{"b_mealplan_included_name":"breakfast","b_rate_is_cug_business_rate":0,"b_block_id":"50699001_179538328_2_41_0","b_max_persons":2,"b_stay_prices":[{"b_local_price":0,"b_raw_price":"","b_stays":0,"b_price":""},{"b_price":"LKR19,962.80","b_stays":1,"b_raw_price":"19962.80","b_local_price":19962.800363943},{"b_price":"LKR39,925.60","b_local_price":39925.600727886,"b_stays":2,"b_raw_price":"39925.60""[truncated 8154 bytes]; line: 1, column: 5774]>}

[2019-12-23T13:14:18,069][WARN ][logstash.filters.split   ] Only String and Array types are splittable. field:event is of type = NilClass
[2019-12-23T13:14:18,071][WARN ][logstash.filters.split   ] Only String and Array types are splittable. field:[event][b_blocks] is of type = NilClass
4

I modified the gsub filter to following and it's working,

 mutate {
    gsub => [
      "message", '^b_rooms_available_and_soldout:', '',
      "message", "],$", "]",
      "message", " ", ""
      ]
  }

Adding some more json data to confirm.

5

@Christian_Dahlqvist
Thanks! It’s working perfectly.