I passed http request from packetbeat to logstash and now I have json in htttp.request.body.content:
How can I split this string to separate fields?
I want to have
id, timestamp and value field..
I tried using grok, json filter etc but without results
Use a json filter. Check on the JSON tab in that view, is the http.request.body.content field really [http][request][body][content]?
I used json filter as you recommended and it's working like a charm. Thank you for help
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.