Split json in string from packetbeat

Elastic Stack Logstash
1

Hello
I passed http request from packetbeat to logstash and now I have json in htttp.request.body.content:

image
image828×406 24.5 KB

How can I split this string to separate fields?
I want to have
id, timestamp and value field..

I tried using grok, json filter etc but without results

2

Use a json filter. Check on the JSON tab in that view, is the http.request.body.content field really [http][request][body][content]?

3

Hi
I used json filter as you recommended and it's working like a charm. Thank you for help

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.