SOLVED - Logstash Filter Help - Hash

(Wayne Taylor) #1


I have an SQS message which has an embedded message that I want to parse and take out each element. I have SQS input working - but when it gets to ES it looks for the message part. Example

"type": "UPDATE",
"attributes": {
"id": "123456"
"technology": "NC",
"state": "TOUCHDOWN",
"owner": "SLI"

I want to use type for document type, ID for document ID and have the owner etc as actual elements.

In Kibana UI the fields look like etc.

Any ideas.


(Magnus B├Ąck) #2

You can use a mutate filter to rename fields from e.g. [REALTIMEEVENT][technology] to plain technology. To set the document type and id in your elasticsearch output, reference the fields whose values you want to pick up using the %{fieldname} notation described at

(Wayne Taylor) #3

Thank you @magnusbaeck - the rename worked fine. As for the referencing fields I had that covered - but thanks :slight_smile:

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.