SOLVED - Logstash Filter Help - Hash

[Wayne_Taylor]

Team,

I have an SQS message which has an embedded message that I want to parse and take out each element. I have SQS input working - but when it gets to ES it looks for the message part. Example

"REALTIMEEVENT": {
"type": "UPDATE",
"attributes": {
"id": "123456"
"technology": "NC",
"state": "TOUCHDOWN",
"owner": "SLI"
}
}

I want to use type for document type, ID for document ID and have the owner etc as actual elements.

In Kibana UI the fields look like REALTIMEEVENT.attributes.id etc.

Any ideas.

Thanks

[magnusbaeck (Magnus Bäck)]

You can use a mutate filter to rename fields from e.g. [REALTIMEEVENT][technology] to plain technology. To set the document type and id in your elasticsearch output, reference the fields whose values you want to pick up using the %{fieldname} notation described at https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references.

[Wayne_Taylor]

Thank you @magnusbaeck - the rename worked fine. As for the referencing fields I had that covered - but thanks