Parse string escaped JSON inside message

In logstash the event I receive from http input is

{  
   "event"   =>   {  
      "@timestamp"      =>2019-04-24T09:17:29.940      Z,
      "headers"      =>      {  
         "http_host"         =>"localhost:5055         ", "         http_version"=>"HTTP/1.1",
         "connection"         =>"close",
         "http_accept"         =>nil,
         "request_path"         =>"/",
         "http_user_agent"         =>"httpget",
         "request_method"         =>"POST",
         "content_length"         =>"296",
         "accept_language"         =>"application/json",
         "content_type"         =>"application/x-www-form-urlencoded",
         "accept_encoding"         =>"identity"
      },
      "message"      =>"      [  
         {  
            \"job_result\":{  
               \"job_template_name\":\"Test Job\",
               \"frequency\":\"daily\",
               \"job_id\":\"21751\",
               \"api_version\":\"v1\",
               \"template_id\":\"312\"
            }
         }
      ]      ", "      @version"=>"1",
      "host"      =>"10.10.112.16"
   }
}

I want the content inside the message as parsed JSON like

{  
   "job_result":{  
      "job_template_name":"Test Job",
      "frequency":"daily",
      "job_id":"21751",
      "api_version":"v1",
      "template_id":"312"
   }
}

I used the below filter

json {
        source => "message"
        remove_field => [ "headers" ]
      }

but I see the output comes as

{  
   "@timestamp":"2019-04-24T09:17:21.959Z",
   "headers":{  
      "http_host":"localhost:5055",
      "http_version":"HTTP/1.1",
      "connection":"close",
      "http_accept":null,
      "request_path":"/",
      "http_user_agent":"httpget",
      "request_method":"POST",
      "content_length":"296",
      "accept_language":"application/json",
      "content_type":"application/x-www-form-urlencoded",
      "accept_encoding":"identity"
   },
   "message":"[{\"job\": {\"job_template_name\": \"Test Job\", \"frequency\": \"daily\", \"job_id\": \"21751\", \"api_version\": \"v1\", \"template_id\": \"312\"}}]",
   "@version":"1",
   "host":"10.51.222.16"
}

how do I get the content inside message as parsed JSON?

If the JSON is an array then target is not optional, since otherwise the json filter does not know what field to put the output in.

Thanks. It worked!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.