[SOLVED] Split filter question a.k.a flatten json sub array

Elastic Stack Logstash
10

let me add that the json looks more like this, so it contains several objects

[{
"Action": "COUNT",
"Timestamp": "2018-05-02T15:36:14Z",
"Request": {
"Country": "PT",
"URI": "/uploadMultiplePhotos.aspx",
"Headers": [{
"Name": "Host",
"Value": "www.example.net"
}, {
"Name": "Content-Length",
"Value": "175253"
}, {
"Name": "origin",
"Value": "https://www.example.net"
}, {
"Name": "user-agent",
"Value": "Mozilla/5.0 (Linux; Android 7.0; LG-M200 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.126 Mobile Safari/537.36"
}, {
"Name": "content-type",
"Value": "multipart/form-data; boundary=----WebKitFormBoundaryXBuUMINHBoY9jHwN"
}, {
"Name": "accept",
"Value": "application/json"
}, {
"Name": "cache-control",
"Value": "no-cache"
}, {
"Name": "x-requested-with",
"Value": "XMLHttpRequest"
}, {
"Name": "save-data",
"Value": "on"
}, {
"Name": "x-ajax",
"Value": "blabla"
}, {
"Name": "referer",
"Value": "https://www.example.net/blabla"
}, {
"Name": "accept-encoding",
"Value": "gzip, deflate, br"
}, {
"Name": "accept-language",
"Value": "pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7,es;q=0.6"
}, {
"Name": "cookie",
"Value": "blabla"
}],
"ClientIP": "8.8.8.8",
"Method": "POST",
"HTTPVersion": "HTTP/2.0"
},
"Weight": 1
},{
"Action": "COUNT",
"Timestamp": "2018-05-02T15:36:14Z",
"Request": {
"Country": "PT",
"URI": "/uploadMultiplePhotos.aspx",
"Headers": [{
"Name": "Host",
"Value": "www.example.net"
}, {
"Name": "Content-Length",
"Value": "175253"
}, {
"Name": "origin",
"Value": "https://www.example.net"
}, {
"Name": "user-agent",
"Value": "Mozilla/5.0 (Linux; Android 7.0; LG-M200 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.126 Mobile Safari/537.36"
}, {
"Name": "content-type",
"Value": "multipart/form-data; boundary=----WebKitFormBoundaryXBuUMINHBoY9jHwN"
}, {
"Name": "accept",
"Value": "application/json"
}, {
"Name": "cache-control",
"Value": "no-cache"
}, {
"Name": "x-requested-with",
"Value": "XMLHttpRequest"
}, {
"Name": "save-data",
"Value": "on"
}, {
"Name": "x-ajax",
"Value": "blabla"
}, {
"Name": "referer",
"Value": "https://www.example.net/blabla"
}, {
"Name": "accept-encoding",
"Value": "gzip, deflate, br"
}, {
"Name": "accept-language",
"Value": "pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7,es;q=0.6"
}, {
"Name": "cookie",
"Value": "blabla"
}],
"ClientIP": "8.8.8.8",
"Method": "POST",
"HTTPVersion": "HTTP/2.0"
},
"Weight": 1
},{
"Action": "COUNT",
"Timestamp": "2018-05-02T15:36:14Z",
"Request": {
"Country": "PT",
"URI": "/uploadMultiplePhotos.aspx",
"Headers": [{
"Name": "Host",
"Value": "www.example.net"
}, {
"Name": "Content-Length",
"Value": "175253"
}, {
"Name": "origin",
"Value": "https://www.example.net"
}, {
"Name": "user-agent",
"Value": "Mozilla/5.0 (Linux; Android 7.0; LG-M200 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.126 Mobile Safari/537.36"
}, {
"Name": "content-type",
"Value": "multipart/form-data; boundary=----WebKitFormBoundaryXBuUMINHBoY9jHwN"
}, {
"Name": "accept",
"Value": "application/json"
}, {
"Name": "cache-control",
"Value": "no-cache"
}, {
"Name": "x-requested-with",
"Value": "XMLHttpRequest"
}, {
"Name": "save-data",
"Value": "on"
}, {
"Name": "x-ajax",
"Value": "blabla"
}, {
"Name": "referer",
"Value": "https://www.example.net/blabla"
}, {
"Name": "accept-encoding",
"Value": "gzip, deflate, br"
}, {
"Name": "accept-language",
"Value": "pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7,es;q=0.6"
}, {
"Name": "cookie",
"Value": "blabla"
}],
"ClientIP": "8.8.8.8",
"Method": "POST",
"HTTPVersion": "HTTP/2.0"
},
"Weight": 1
}]