Okay,
So how do i point the field agentevent.details to json filter?
I tried
json {
source => "agentevent.details"
}
But this gives an error.
In the thread you linked you had this field created but how can i access this with XML? If use xpath to create fields before mutate, i will have all the names and values in those fields;
mutate { add_field => { "%{[Request][Headers][Name]}" => "%{[Request][Headers][Value]}" } }