Removing parent fields and keeping nested fields of JSON

Elastic Stack Logstash
1

I am getting the following event in my filter section

 {   
            "@timestamp" => 2017-06-23T06:16:05.000Z,
              "@version" => "1",
                 "event" => {
                   "logLevel" => "INFO",
                "description" => "This is description",
                  "className" => "ClassName",
                  "eventType" => "TEST_EVENT"
                 }
}

I want to remove event parent from the json. Output expected

 {   
            "@timestamp" => 2017-06-23T06:16:05.000Z,
              "@version" => "1",
                   "logLevel" => "INFO",
                "description" => "This is description",
                  "className" => "ClassName",
                  "eventType" => "TEST_EVENT"
}

Any help would be appreciated.

2

If the number of subfields is known just use a mutate filter's rename option. Otherwise you'll have to use a ruby filter. I'm sure examples have been posted in the past.

1 Like
3

Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.