Split data in message field to separate fields to display in kibana

Hi,
I am using logstash and ES to feed data into kibana. Sending Json data to kibana.Below is the json data:

{"Qmgrs":[{"QueueManager":"QM1","Status":"Running"},{"QueueManager":"QM2","Status":"Ended immediately"},{"QueueManager":"QM3","Status":"Running"}]}

However all the fields are appearing under the message field. How do I split it to individual fields such that I can prepare dashboard on kibana querying QueueManager or status etc. Below is my conf file:

input {
     file {
        path => "/home/ajayakumar/mqsiListPOC/Sample.json"
        sincedb_path => "/dev/null"
        start_position => "beginning"

  }
}

filter {
    json{
        source => "message"
      
    }
}

output {
   elasticsearch {
       hosts => [ "localhost:9200" ]
       index => "qmstatusdisp"
       }
  stdout {}
 }

P.s: I have already tried using the json codec as well. I have gone through few other posts but didnt help. Kindly help me out on this.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.