Parse json data into elasticsearch

Elastic Stack Logstash
1

I have this json downloaded from a website:

   [
                 {
                     "data": "2020-02-24 21:00:00",
                     "stato": "ITA",
                     "codice_regione": 13,
                     "denominazione_regione": "Abruzzo",
                     "codice_provincia": 69,
                     "denominazione_provincia": "Chieti",
                     "sigla_provincia": "CH",
                     "lat": 42.35103167,
                     "long": 14.16754574
                 },
                 {
                     "data": "2020-02-24 21:00:00",
                     "stato": "ITA",
                     "codice_regione": 13,
                     "denominazione_regione": "Abruzzo",
                     "codice_provincia": 66,
                     "denominazione_provincia": "L'Aquila",
                     "sigla_provincia": "AQ",
                     "lat": 42.35122196,
                     "long": 13.39843823
                 }
          ]

this is my logstash conf file:

input {

 http_poller {

    urls => {
     test => {
        url => "https://website.example/file-test.json"
    }
   }
    schedule => { every => "1m"}
    request_timeout => 60
    socket_timeout =>  30
  codec => json
 }

}

filter {

}

output {
  elasticsearch {
     hosts => "http://localhost:9200"
     index => "test"
  }
stdout { codec => rubydebug }
    
}

This is my json into elasticsearch:

{
  "_index": "test",
  "_type": "_doc",
  "_id": "e7sYxHAB6obTCirlaTRZ",
  "_version": 1,
  "_score": null,
  "_source": {
    "sigla_provincia": "CH",
    "stato": "ITA",
    "codice_regione": 13,
    "denominazione_regione": "Abruzzo",
    "data": {
      "times_retried": 0,
      "code": 200,
      "response_headers": {
        "x-timer": "S1583837864.162891,VS0,VE167",
        "vary": "Authorization,Accept-Encoding",
        "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox",
        "strict-transport-security": "max-age=31536000",
        "x-served-by": "cache-ams21032-AMS",
        "source-age": "0",
        "date": "Tue, 10 Mar 2020 10:57:44 GMT",
        "x-fastly-request-id": "3119e4c03477229b164531883400ee44aaf3866f",
        "expires": "Tue, 10 Mar 2020 11:02:44 GMT",
        "x-cache-hits": "0, 1",
        "content-type": "text/plain; charset=utf-8",
        "via": [
          "1.1 varnish (Varnish/6.0)",
          "1.1 varnish"
        ],
        "x-frame-options": "deny",
        "x-content-type-options": "nosniff",
        "x-cache": "HFM, HIT",
        "etag": "W/\"6918f61acb7a11c7e7479a71c3c44265a4df69979a43add80dcbaab28e1dcc21\"",
        "accept-ranges": "bytes",
        "connection": "keep-alive",
        "x-xss-protection": "1; mode=block",
        "access-control-allow-origin": "*",
        "x-github-request-id": "3E72:67A2:3FC97D:54DE79:5E672959",
        "cache-control": "max-age=300",
        "x-geo-block-list": ""
      },
      "host": "ubuntu",
      "name": "test",
      "request": {
        "url": "https://website.example/file-test.json",
        "method": "get"
      },
      "runtime_seconds": 1.038294,
      "response_message": "OK"
    },
    "long": 14.16754574,
    "lat": 42.35103167,
    "codice_provincia": 69,
    "denominazione_provincia": "Chieti",
    "@timestamp": "2020-03-10T10:57:44.979Z",
    "@version": "1"
  },
  "fields": {
    "@timestamp": [
      "2020-03-10T10:57:44.979Z"
    ]
  },
  "highlight": {
    "denominazione_provincia": [
      "@kibana-highlighted-field@Chieti@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1583837864979
  ]
}

As you can see I lost my field "data" from json file. How can I solve it?

2

Solved ! I used wrongly metadata_target => "data" in input

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.