Parsing json with delimiters using logstash

Elastic Stack Logstash
6

@LoriG

What you need is not easy, but I think I managed to do it.
I tried to do it without using ruby plugin, but for your final need, I have no simpler solution.

grok {
  match => ["message", "ReportBody:%{GREEDYDATA:json}"]
}

mutate {
  gsub => [ "json" , "\$", "," ]
}
mutate {
  replace => { "json" => "[%{json}]" }
}
json {
  source => "json"
  target => "json"
}

ruby {
  code => "event['json'].each { |item| event[item['prop2']] = item['count'] }"
}

mutate {
  remove_field => ["message","json"]
}