Parsing nested JSON with dynamic key

Elastic Stack Logstash
1

Given the following JSON, I would like to be able to extract the genreId.
However, I am not sure how to do so with nested dynamic keys (in the example below, "610015")

{
"b_shopId": 502192,
"body": {
"delivery": {
"deliveryName": "My Delivery"
},
"item": {
"610015": {
"genreId": 216461
}
},
"orderNumber": "502192-20190320-00066801",
"statusId": 1
}
}

My filter currently is defined as follows, but obviously fails due to the name "aDynamicKey":

filter {

json {
   source => "message"
  #  target => "message_target"
}
split {
  field => "[body]"
}

mutate {
  add_field => {
    "b_shopId" => "%{[body][shop][shopId]}"
    "b_genreId" => "%{[body][aDynamicKey][genreId]}"
  }
 }
 mutate {
 convert => {
    "b_shopId" => "integer"
 }

  remove_field => [ "[message]" ]
}

}

2

You could do that with ruby

    ruby {
        code => '
            h = event.get("[body][item]")
            h.each { |k, v|
                v.each { |l, w|
                    event.set(l, w)
                }
            }
        '
    }
1 Like
3

Thanks that did the trick!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.