Hello, dear community, I am brand new to logstash, but have to fix a problem:
We are gathering eks audit logs and have errors like illegal_state_exception error because of the field responseObject.status could be the type of string or object. I came up to define mapping for this field in elastic as oject and in logstash config rename responseObject.status field to responseObject.statusString e.g. if the value is string. The link above describe the possible solution, but i cant figure out how exactly to do it for nested field like in my case. Another question is that erros being genereted in json filter plugin, may I put the condition that i going to write before json filter plugin? Thanks in advance!
The part of current config looks like:
input {
cloudwatch_logs {
log_group => ""
region => "eu-central-1"
role_arn => ""
start_position => "end"
type => "eks"
}
}
# ========= Filter ========================
filter {
if [type] == "eks"{
mutate {
convert => {"[responseObject][status]" => "string"}
}
json{
source => "message"
remove_field => "message"
skip_on_invalid_json => true
}
}
}