Parsing array of json objects with logstash and injesting to elastic

Elastic Stack Logstash
2

None of the individual lines are valid JSON. The entire array is almost valid JSON (you need to remove the , that precedes the ]). You can read the entire file as a single event using a multiline codec with a pattern that never matches

codec => multiline { pattern => "^Spalanzani" negate => true what => previous auto_flush_interval => 1 multiline_tag => "" }

Then split the array

    split { field => "someField" }
    date { match => [ "[someField][date]", "YYYY-MM-dd'T'HH:mm:ssZZ" ] }

If you need to move the contents of [someField] to the top level you can do it in a ruby filter similar to this.

2 Likes