New to logstash, Need help to fetch the value from the spcecific column, which is array of strings

Elastic Stack Logstash
1

Need help to display values of specific column column18 as fields, column is array of strings

Below is the column18:
{"accept":["text/html, image/gif, image/jpeg, *; q=.2, /; q=.2"],"host":["xxx.xx.xxx.com"],"pragma":["no-cache"],"user-agent":["Java/1.7.0_67"],"x-forwarded-for":["66.77.88.196"],"x-forwarded-port":["443"],"x-forwarded-proto":["https"]}

My conf file is
filter{
if [type] == "fraccess" {
csv {
columns => ["id","timestamp","eventName","transactionId","userId","trackingIds","server.ip","server.port","client.ip","client.port","request.protocol","request.operation","request.detail","component","realm"]
separator => ","
}
date {
match => ["time", "yyyy-MM-dd HH:mm:ss"]
}
}

    if [type] == "fraccess"   {
            mutate {
            add_field => { "indexname" => "am13.5" }
          

    }

}

2

{"accept":["text/html, image/gif, image/jpeg, *; q=.2, /; q=.2"],"host":["xxx.xx.xxx.com"],"pragma":["no-cache"],"user-agent":["Java/1.7.0_67"],"x-forwarded-for":["66.77.88.196"],"x-forwarded-port":["443"],"x-forwarded-proto":["https"]}

This is JSON. Use a json filter to parse it.

3

Hi,
Thanks for quick response, column18 which I am referring is after parsing a csv file, so please let me know how to include json parser in the conf file to filter the column18 which is as Json data.

Regards,
Sridhar

4

You already have three filters in your configuration file so it's not clear what part you're finding difficult. Just add a json filter somewhere after the csv filter and make sure to set its source option to find to the name of the field containing the JSON data.

5

Thanks,
It's working able to parse JSON data.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.