Parse string escaped JSON inside message

Elastic Stack Logstash
1

In logstash the event I receive from http input is

{  
   "event"   =>   {  
      "@timestamp"      =>2019-04-24T09:17:29.940      Z,
      "headers"      =>      {  
         "http_host"         =>"localhost:5055         ", "         http_version"=>"HTTP/1.1",
         "connection"         =>"close",
         "http_accept"         =>nil,
         "request_path"         =>"/",
         "http_user_agent"         =>"httpget",
         "request_method"         =>"POST",
         "content_length"         =>"296",
         "accept_language"         =>"application/json",
         "content_type"         =>"application/x-www-form-urlencoded",
         "accept_encoding"         =>"identity"
      },
      "message"      =>"      [  
         {  
            \"job_result\":{  
               \"job_template_name\":\"Test Job\",
               \"frequency\":\"daily\",
               \"job_id\":\"21751\",
               \"api_version\":\"v1\",
               \"template_id\":\"312\"
            }
         }
      ]      ", "      @version"=>"1",
      "host"      =>"10.10.112.16"
   }
}

I want the content inside the message as parsed JSON like

{  
   "job_result":{  
      "job_template_name":"Test Job",
      "frequency":"daily",
      "job_id":"21751",
      "api_version":"v1",
      "template_id":"312"
   }
}

I used the below filter

json {
        source => "message"
        remove_field => [ "headers" ]
      }

but I see the output comes as

{  
   "@timestamp":"2019-04-24T09:17:21.959Z",
   "headers":{  
      "http_host":"localhost:5055",
      "http_version":"HTTP/1.1",
      "connection":"close",
      "http_accept":null,
      "request_path":"/",
      "http_user_agent":"httpget",
      "request_method":"POST",
      "content_length":"296",
      "accept_language":"application/json",
      "content_type":"application/x-www-form-urlencoded",
      "accept_encoding":"identity"
   },
   "message":"[{\"job\": {\"job_template_name\": \"Test Job\", \"frequency\": \"daily\", \"job_id\": \"21751\", \"api_version\": \"v1\", \"template_id\": \"312\"}}]",
   "@version":"1",
   "host":"10.51.222.16"
}

how do I get the content inside message as parsed JSON?

2

If the JSON is an array then target is not optional, since otherwise the json filter does not know what field to put the output in.

3

Thanks. It worked!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.