Partially flatten json structure in logstash filter


#1

Hi,

We have

{
"recordA": {
"recordB": {
"someField1" : "john"
"somefield2": "smith"
}
}
}
and wish to move the fields up one level so recordB disappears and the fields are directly under recordA.

{
"recordA": {
"someField1" : "john"
"somefield2": "smith"
}
}

Can you help please?


(Magnus B├Ąck) #2

Use a mutate filter and its rename option.


#3

Thanks.

{
"recordA": {
            "recordB": {
                       "someField1" : "john"
                       "somefield2": "smith"
                  }
           }
}

I cannot figure out the syntax for the rename and have not succeeded finding online.
Somehow I need to access [recordA][recordB][somefield1] and make it [recordA][somefield1]


#4

Thanks got working.


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.