Nested json inside a json also getting parsed into different fields using JSON Filter Plugin


I have a nested JSON inside a JSON field which is also getting parsed. I do not want to parse the nested JSON. example json:

log : {"name":"abc","location":{"city":"New York","country":"US"}}

Logstash filter:
json {
source => "log"

Parsed as
"":"New York",

But the requirement is to have it in this format
"location":"{"city":"New York","country":"US"}"

You cannot stop it parsing it, you could re-encode it using the json_encode filter.

The problem is its not just 2-3 fields but 1000s of fields in the nested json which is causing a mapping explode in the index. I need to stop the nested json to be parsed into different fields.

Maybe you should turn off dynamic mapping.

Thanks @Badger, disabling dynamic mapping helped. Mapping as below

"location" : {
"type" : "object",
"enabled" : false

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.