Reading json file through logstash

Elastic Stack Logstash
1

I have a json in the below format

abc def{"DeviceId": "00D0","From": "LA","NotificationType": "Message","PublishTime": "2016-08-12T16:00:01.0995115+00:00",{"Version": "1.0","DeviceId": "00D0","From": "00D0"}

how can i ignore the abc def before the json and the above json is in single line. Can logstash parse something in the above format?

Thanks in advance

2

Either

  • use a grok filter to extract "abc def" to one or more fields and the JSON payload to another field and feed the latter to the json filter, or
  • if you just want to delete "abc def" use a mutate filter and its gsub option to remove it (and feed the resulting string to the json filter).
3

Thanks for the reply. Here, I am using a python code to resolve this