Hi All ,
I have a specific problem related to json parsing and extracting particular field for indexing
My sample json message is
{"log_time":"1/Sep/2015:12:35:50 +05:30","level":"INFO","log_message":"test message","description":"{"field1":"some data","field2":"some data "}","url":"some url","module":"some module","log_host":"localhost"}
description field is a string which itself is json
I want to extract only first 2 fields from description and add them as separate field in the even .
So my final output should be like
{
"message" => "{"log_time":"1/Sep/2015:12:35:50 +05:30","level":"INFO","log_message":"test message","description":"{"field2":"some data","field2":"some data "}","url":"some url","module":"some module","log_host":"localhost"}",
"@version" => "1",
"@timestamp" => "2015-09-03T11:20:43.881Z",
"host" => "localhost",
"log_time" => "1/Sep/2015:12:35:50 +05:30",
"level" => "INFO",
"log_message" => "test message",
"description" => ""description":"{"field2":"some data","field2":"some data"}"",
"url" => "some url",
"module" => "some module",
"log_host" => "localhost",
"field1" => "some data",
"field2" => "some data"
}
Note : description is having dynamic number of fields , it can be 2 or more .
Thanks & Regards
Arvind
Software Engg.
Shopclues.com