Split json in string from packetbeat

I passed http request from packetbeat to logstash and now I have json in htttp.request.body.content:

How can I split this string to separate fields?
I want to have
id, timestamp and value field..

I tried using grok, json filter etc but without results

Use a json filter. Check on the JSON tab in that view, is the http.request.body.content field really [http][request][body][content]?

I used json filter as you recommended and it's working like a charm. Thank you for help

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.