Updated Filter which flattens double nested JSON-
Ref link-https://discuss.elastic.co/t/flatten-json-array-in-logstash-filter/124562
filter{
split { field => "[resources]" }
mutate {
add_field => {
"resource_price_per_hour" => "%{[resources][price_per_hour]}"
"resource_instance_count" => "%{[resources][instance_count]}"
"resource_name" => "%{[resources][name]}"
"resource_sku" => "%{[resources][sku]}"
"resource_price" => "%{[resources][price]}"
"resource_hours" => "%{[resources][hours]}"
"resource_kind" => "%{[resources][kind]}"
"resource_period_start" => "%{[resources][period][start]}"
"resource_period_end" => "%{[resources][period][end]}"
}
remove_field => [ "[resources]" ]
}
split { field => "[data_transfer_and_storage]" }
mutate {
add_field => {
"data_name" => "%{[data_transfer_and_storage][name]}"
"data_sku" => "%{[data_transfer_and_storage][sku]}"
"data_cost" => "%{[data_transfer_and_storage][cost]}"
"data_type" => "%{[data_transfer_and_storage][type]}"
"data_quantity1" => "%{[data_transfer_and_storage][quantity][formatted_value]}"
"data_quantity2" => "%{[data_transfer_and_storage][quantity][value]}"
"data_rate1" => "%{[data_transfer_and_storage][rate][formatted_value]}"
"data_rate2" => "%{[data_transfer_and_storage][rate][value]}"
}
remove_field => [ "[data_transfer_and_storage]" ]
}
}