Nested json inside a json also getting parsed into different fields using JSON Filter Plugin

[ParashB (Paras)]

Hi,

I have a nested JSON inside a JSON field which is also getting parsed. I do not want to parse the nested JSON. example json:

log : {"name":"abc","location":{"city":"New York","country":"US"}}

Logstash filter:
json {
source => "log"
}

Parsed as
{
"name":"abc",
"location.city":"New York",
"location.country":"US"
}

But the requirement is to have it in this format
{
"name":"abc",
"location":"{"city":"New York","country":"US"}"
}

[Badger]

You cannot stop it parsing it, you could re-encode it using the json_encode filter.

[ParashB (Paras)]

The problem is its not just 2-3 fields but 1000s of fields in the nested json which is causing a mapping explode in the index. I need to stop the nested json to be parsed into different fields.

[Badger]

Maybe you should turn off dynamic mapping.

[ParashB (Paras)]

Thanks @Badger, disabling dynamic mapping helped. Mapping as below

"location" : {
"type" : "object",
"enabled" : false
}