I have multiple Kubernetes clusters sending logs to S3 , then I use logstash to read logs off S3 files. Some logs messages are in JSON , others in structured format.
How to dynamically detect and parse JSON , and save non-JSON as it is. I use this filter but not working.
filter {
if [message] =~ "\A\{.+\}\z" {
json {
source => "message"
}
mutate { add_field => { "json_detected" => "This is json log" } }
}
}
Thanks