Need to convert specific part of message to json in logstash

Elastic Stack Logstash
1

This is my message filed in logs

{'v':'100001','lj':'f', 'level':'warnining', sys:{'sys':'',v:'',host:''},'tt':'a.db.all',o:{a:{b:{c:100}}}, err:{e:{status:300,message:'someException',stack:'abc prq ' } } }

The output I get after changing it to json in filter and by applying codec => json in input is as follows:

parsedMessage.err.e.message someException
parsedMessage.err.e.stack abc prq
parsedMessage.err.e.status 300
parsedMessage.level warnining
parsedMessage.lj f
parsedMessage.o.a.b.c 100
parsedMessage.sys.host
parsedMessage.sys.sys
parsedMessage.sys.v
parsedMessage.tt a.db.all
parsedMessage.v 100001
pid 27,102
serverName honey-ThinkPad-L430
type syslog

But I didn't want to convert "O" to json rather i want to keep it as string.
Please help me out with this.

2

Use the json_encode filter to encode the [parsedMessage][o] field back to a JSON string.

3

But It shows error in Elasticsearch-6.0.0.

4

What Logstash configuration results in an error? What's the error?

Please spend a little more time asking your question so that it's possible to answer.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.