Parse either json or non json logs in logstash

Elastic Stack Logstash
1

here is my log messages with two farmats in response section :
this one non json in response

2025-03-12 10:52:19,645 INFO  REQUEST:/auth/authorize?response_type=code RESPONSE:APPROVED amount:1000

this one json in reponse :

2025-03-12 10:52:19,645 INFO  REQUEST:/auth/authorize?response_type=code RESPONSE:{"access_token":"******"}

I used :
json { source => "responseBody" target => "response" }
but I have both non json and json in response , how can I parse both ?

2

Can you share the rest of your pipeline?

How are you creating the responseBody field?

You will need to validate if this field is a json or not, by checking if it has the { in the value for example and then use a conditional to parse it as a json and store in a different field as well as you cannot use the same field for both.

1 Like
3

this is an example of non json response :
RESPONSE:APPROVED amount:1000
how to use if conditional in this case , the response doesn't contain { .