Split data in message field to separate fields to display in kibana

Elastic Stack Logstash
1

Hi,
I am using logstash and ES to feed data into kibana. Sending Json data to kibana.Below is the json data:

{"Qmgrs":[{"QueueManager":"QM1","Status":"Running"},{"QueueManager":"QM2","Status":"Ended immediately"},{"QueueManager":"QM3","Status":"Running"}]}

However all the fields are appearing under the message field. How do I split it to individual fields such that I can prepare dashboard on kibana querying QueueManager or status etc. Below is my conf file:

input {
     file {
        path => "/home/ajayakumar/mqsiListPOC/Sample.json"
        sincedb_path => "/dev/null"
        start_position => "beginning"

  }
}

filter {
    json{
        source => "message"
      
    }
}

output {
   elasticsearch {
       hosts => [ "localhost:9200" ]
       index => "qmstatusdisp"
       }
  stdout {}
 }

P.s: I have already tried using the json codec as well. I have gone through few other posts but didnt help. Kindly help me out on this.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.