Noob question

Elastic Stack Logstash
1

Hello, i new to logstash i wrestingling abit with getting json input that i want to send to http output.
My Json looks like this:

{
          "Space" => {
        "SpaceId" => "4510"
    },
    "HttpRequest" => {
            "UserAgent" => "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.101 Safari/537.36",
               "Method" => "POST",
              "Browser" => "Google Chrome"
    },
    "CurrentUser" => {
          "SecurityId" => "323cd22e-32b1-481f-a4d5-bc95b76f174e",
          "ContractId" => "9fe4effd-6f41-4a25-b965-c4c25bdbccc6",
        "ContractName" => "ElisKontrakt"
    },
       "ListName" => "Elis DataSet222",
            "@mt" => "Created list {ListName}, {StoreLog}",
        "LogType" => "Audit",
             "@l" => "Information",
             "@m" => "Created list \"Elis DataSet222\", True",
         "System" => {
        "IsScheduler" => false,
    },
       "StoreLog" => true,
    "_index_name" => "MyRedisIndex",
     "@timestamp" => 2017-08-30T08:20:37.998Z,
             "@t" => "2017-08-30T07:50:00.6050142Z",
       "@version" => "1"
}

I want to post the listname and current user securityId. This is my input:

input { 
  redis {
    host => "10.0.75.1"
    data_type => "list"
    key => "mylog"
	codec => "json_lines"
    # batch_count => 1
    # threads => 1
  }
}

Can someone kind person help me with how I read the json field and including it in my post. I have manage to post but not include any of the incomming values.
Any help is most appriciated.
Regards
Elis.

2

The string you get from Redis, is it 'pretty printed' like in your post above?

If yes, then it will not work.

Logstash JSON codecs expect a single line with one JSON object or a single line of one JSON array with JSON objects in the array.

A codec called json_pretty might be published soon that would help. Watch https://github.com/logstash-plugins for progress.

1 Like
3

Another option, perhaps better, is to use the plain codec and the json filter. In other words, just receive the text as is and decode it later with the json filter.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.