Renaming dynamic nested json message fields

Elastic Stack Logstash
1

I have the following json data

{
"parent" : {
"child_1" : {
"field_1":123,
"field_2":"my_child_1_string"
},
"child_2" : {
"field_1":456,
"field_2":"my_child_2_string"
}
}
}

I need to be able to find all fields that are under a parent and rename that child with a field under the child. For example for the above it should look like

{
"parent" : {
"my_child_1_string" : {
"field_1":123,
"field_2":"my_child_1_string"
},
"my_child_2_string" : {
"field_1":456,
"field_2":"my_child_2_string"
}
}
}

I think I need to possibly use a mutate filter for this or maybe something else. Not sure.

Hope you can help out.

2

The mutate filter won't be enough. You'll have to write a snippet of Ruby code in a ruby filter. I'm afraid I don't have an example of exactly what you need.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.