Hi @Patryk_Miszczak,
As suggested here, you'd better properly re-ingest your data so that log
field is indexed as an object, not as a string.
If it's something out of your control and you need to extract just some fraction of the data from log
field you can create a scripted field and use Painless API to extract the data you need. Painless doesn't support any specific JSON functionality, but you can use String
functions like indexOf
and substring
to extract pieces you're interested in.
Thanks,
Oleg