Partially flatten json structure in logstash filter

Elastic Stack Logstash
1

Hi,

We have

{
"recordA": {
"recordB": {
"someField1" : "john"
"somefield2": "smith"
}
}
}
and wish to move the fields up one level so recordB disappears and the fields are directly under recordA.

{
"recordA": {
"someField1" : "john"
"somefield2": "smith"
}
}

Can you help please?

2

Use a mutate filter and its rename option.

3

Thanks.

{
"recordA": {
            "recordB": {
                       "someField1" : "john"
                       "somefield2": "smith"
                  }
           }
}

I cannot figure out the syntax for the rename and have not succeeded finding online.
Somehow I need to access [recordA][recordB][somefield1] and make it [recordA][somefield1]

4

Thanks got working.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.