Parse mixed type of data inside json {[array],keys:values}

Elastic Stack Logstash
1

How to parse mixed type of data inside json {[array],keys:values} ?
{
"body": {
"date": "1548930893906",
"id": "3987741004",
"origin": "web",
"parties": [{
"direction": "in",
"from": {
"name": "Name",
"number": "363289"
},
"id": "cs1693819",
"standAlone": true
}],
"serverId": "lab.env",
"sessionId": "Y3MxNjkzODE5ODM0MDkyNTE5NjFAMTAuMjQuMTQ0Ljk1"
},
"event": "Notify",
"version": "2.3"
}

split { field => "[body][parties]" } - doesn't work because there are keys with values at the end.

[2019-01-31T15:01:34,849][WARN ][logstash.filters.split ] Only String and Array types are splittable. field: [body][parties] is of type = NilClass

2

Did you use a json filter to put it into another field? If so, include that in the field name.

filter {
    json { source => "message" target => "json" }
    split { "field" => "[json][body][parties]" }
}

works just fine for me.

3

i've realized that not all the incoming messages have parties fields, so warning lines in logs belonged to the messages where split module hadn't found [body][parties].

if ("parties" in [body]) {
split { "field" => "[body][parties]" }
}

fixed the issue. Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.