Parse Json Array

Elastic Stack Logstash
1

Trying to parse a Json array like this message

[{"UserDomain":"VOFFICESECURE","UserName":"Administrator","ComputerName":"DC01.vofficesecure.com"},{"UserDomain":"VOFFICESECURE","UserName":"Administrator","ComputerName":"Juliano-PC.vofficesecure.com"}]

I Would like to get Two different documents and can make it happens using below config using the cli and manually inputting the log

input {
stdin {
codec => "json"
}
}
filter {
split { }
}

output {
stdout {
codec => rubydebug
}
}

Im actually receiving that log from filebeat, I tried to use "codec => json" in the input "beats" but cant get the same results using the "split" in filter and indexing in Elasticsearch

Thanks

2

Manage to got it working creating another beats input with json codec in another port.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.