New to Logstash, and I tried to read the documentation as much as possible but still confused..
Can anyone help me grok 'sessionId' and 'user' out of this message? Trying to get the values into new fields.
I know its JSON data, but we are treating it as string for now.
{"data":{"type":"external features","event":"App started"},"House":"44 King St","sessionId":"43-22-33","timestamp":"2019-07-04T23:58:40.405Z","type":"externalFeature","user":"155"}
Thanks Badger,
works well. The reason why I was hesitant to go with a JSON filter, is because there's characters in front of the JSON that were causing parsing errors, and I wasn't quite sure how to trim them.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.