Obtener un json de una entrada de log

[Badger]

@Lucas_Fernandez

filter {
dissect {
mapping => {
"message" => "%{level} [%{ts} %{+ts}] %{guid} %{class} [%{something}] %{json}"
}
}
}

If you change that to

filter {
    dissect { mapping => { "message" => "%{level} [%{ts} %{+ts}] %{guid} %{class} [%{something}] %{json}" } }
    mutate { gsub => [ "json", "^{", '{"', "json", "}$", '"}', "json", ":", '":"', "json", ",", '","' ] }
    filter { json { source => "json" } }
}

then I would expect that to work. The mutate will convert {contrato:12345} into {"contrato":"12345"} and the json filter should work just fine on that.