Nested json using logstash mutate filter

Elastic Stack Logstash
1

I have the below json where i am trying to create a new json field using the mutate filter but i am not getting the expected results. below is my json and the filter i used

Actual Json:

{
"@timestamp": "2019-08-23T14:52:17.830Z",
"type": "gateway",
"@version": "1",
"message": " Endpoint response headers: {content-type=application/json;charset=UTF-8, date=Fri, 23 Aug 2019 14:52:17 GMT, x-envoy-upstream-service-time=3, server=envoy, transfer-encoding=chunked}"
}

Expected logstash output:

{
"@timestamp": "2019-08-23T14:52:17.830Z",
"type": "gateway",
"@version": "1",
"payload":{
	"message": " Endpoint response headers: {content-type=application/json;charset=UTF-8, date=Fri, 23 Aug 2019 14:52:17 GMT, x-envoy-upstream-service-time=3, server=envoy, transfer-encoding=chunked}"
    }
}

Filter i tried:

filter {
    mutate {
    add_field => { "[payload][message]" => "%{message}" }
    }
}
}

The below one works fine but not giving the expected output

filter {
mutate {
    add_field => { "[payload]" => "%{message}" }
    }
}
}
2

This works for me.

"@timestamp" => 2019-08-23T14:52:17.830Z,
      "type" => "gateway",
   "payload" => {
    "message" => " Endpoint response headers: {content-type=application/json;charset=UTF-8, date=Fri, 23 Aug 2019 14:52:17 GMT, x-envoy-upstream-service-time=3, server=envoy, transfer-encoding=chunked}"
}

Note that @timestamp is a LogStash::Timestamp, not a string.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.