Hi @A_B,
Thanks for this approach.
I am struggling with jsonParse failure.
This is my input:
{ expedia: '{"status":{"code":500,"description":"Internal server error"},"data":"Cannot read property 'toFixed' of undefined"}',status: 'PAYMENT_FAILED' }
Grok Pattern:
%{GREEDYDATA:expediaDetails}$
When I use json filter for expediaDetails, it fails.
expediaDetails Output of logstash:
"expediaDetails" => "{ expedia: status:code:500,status: PAYMENT_FAILED } { expedia: status:description:Internal server error,status: PAYMENT_FAILED } { expedia: data:Cannot read property \'toFixed\' of undefined,status: PAYMENT_FAILED } "
Input is the nested json and the output is very different than the output in grokedebugger.
from the logstash output, I am not able to put the values in new fields. For example I tried below approach. Both are not working.
ruby {
code => 'event.set("statusCode1", event.get("[expediaDetails][expedia][status][code]"))'
}
mutate { add_field => {
"statusCode" => "%{[expediaDetails][expedia][status][code]}"
}
I dont know how to put these values in particular field.
What I understand is, in logstash output, its printing message like an array of values.
So first it prints expedia:status:code:500, later expedia:status:description and so on. But actual input structure is different.
Please help on this.
BR,
Sunil.