Process array elements as objects

Elastic Stack Logstash
1

I am trying to add json data to my elasticsearch with arrays in its field. My setup works, but I want the arrays to become separate fields. Is this possible in logstash or should i create a json parser to fix my problem?

{
	"name": "peter",
	"occupation": "salesman",
	"score": [{
			"result": true,
			"name": "reported"
		},
		{
			"result": false,
			"name": "processed"
		}
	],
	"level": 38,
	"categories": [{
			"category": "owner",
			"passed": false
		},
		{
			"category": "worker",
			"passed": true
		}
	]
}

My config file:

input { stdin {}
}

filter {
        json {
                source => "message"
                target => "message"
        }

}

output {
        elasticsearch {
                hosts => ["IP:9200"]
                        index => "worker"
                        document_id => "%{message}"
                        doc_as_upsert => true
                        action => "update"
                        retry_on_conflict => 10
        }
}
2

I want the arrays to become separate fields

I don't understand what you mean by this. Please give an example of the JSON document you want to get.

3

Why are you using the message field as ID?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.