Parsing json object

Elastic Stack Logstash
1

Hi there,

If someone can help me with this I would be very appreciated. It's so complicated for me. So I have an event like this

{
   "time":"2021-03-12T00:40:57.016Z",
   "severity":"INFO",
   "duration_s":0.02124,
   "db_duration_s":0.00624,
   "view_duration_s":0.015,
   "status":204,
   "method":"POST",
   "path":"/api/v4/jobs/request",
   "params":[
      {
         "key":"info",
         "value":{
            "name":"gitlab-runner",
            "version":"13.9.0",
            "revision":"2ebc4dc4",
            "platform":"linux",
            "architecture":"amd64",
            "executor":"docker",
            "shell":"bash",
            "features":{
               "variables":"[FILTERED]",
               "image":null,
               "services":null,
               "artifacts":null,
               "cache":null,
               "shared":null,
               "upload_multiple_artifacts":null,
               "upload_raw_artifacts":null,
               "session":null,
               "terminal":null,
               "refspecs":null,
               "masking":null,
               "proxy":null,
               "raw_variables":"[FILTERED]",
               "artifacts_exclude":null,
               "multi_build_steps":null,
               "trace_reset":"[FILTERED]",
               "trace_checksum":"[FILTERED]",
               "trace_size":"[FILTERED]",
               "vault_secrets":"[FILTERED]",
               "cancelable":null,
               "return_exit_code":null
            }
         }
      },
      {
         "key":"token",
         "value":"[FILTERED]"
      },
      {
         "key":"last_update",
         "value":"850530bed1cfb46fc50f5ac9d0279288"
      }
   ],
   "ua":"gitlab-runner 13.9.0 (13-9-stable; go1.13.8; linux/amd64)",
   "route":"/api/:version/jobs/request",
   "queue_duration_s":0.00724,
   "redis_calls":5,
   "redis_duration_s":0.002841,
   "correlation_id":"62YEwxh9m9a",
   "meta.caller_id":"/api/:version/jobs/request"
}

I want to get something like if [params][value][name] = gitlab-runner, then put the whole params.value under root.

It will be like

"time":"2021-03-12T00:40:57.016Z",
"severity":"INFO",
"duration_s":0.02124,
"db_duration_s":0.00624,
"view_duration_s":0.015,
"status":204,
"method":"POST",
"path":"/api/v4/jobs/request",
"info. name": "gitlab-runner"
"info.version":"13.9.0"
...
2

[params] is an array, so that would be [params][0][value][name]

You can use a ruby filter to move fields to the root. An example is here.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.