Store json object in a field in logstash

Elastic Stack Logstash
1

consider this log :

{
  "timestamp": "2025-08-04T12:32:50.9698972+03:30",
    "body": {
      "instanceId": "abc123",
      "variable": "testVar",
      "testInt": 42,
      "testBool": true,
      "data": {
        "extendedInstanceId": "ext123",
        "extendedVariable": "extVar",
        "extendedTestInt": 99,
        "extendedTestBool": false
      }
    },
  "response": {
    "code": 400,
    "exceptionName": null,
    "message": null,
    "className": null,
    "methodName": null,
    "lineNumber": null,
    "body": "Error Exception 1 !! Error Exception 2 !! Error Exception 3 !!"
  }
}

I want to store whole response object in a field , how can I do this ?

2

Hello @alex_petrov

I think you can try using below config :

filter {
  json {
    source => "message"
    target => "parsed_json"
  }

  mutate {
    add_field => {
      "[response]" => "%{[parsed_json][response]}"
    }

    rename => {
      "[timestamp]" => "timestamp"
      "[parsed_json][body][instanceId]" => "instanceId"
      "[parsed_json][body][variable]" => "variable"
      "[parsed_json][body][testInt]" => "testInt"
      "[parsed_json][body][testBool]" => "testBool"
      "[parsed_json][body][data][extendedInstanceId]" => "extendedInstanceId"
      "[parsed_json][body][data][extendedVariable]" => "extendedVariable"
      "[parsed_json][body][data][extendedTestInt]" => "extendedTestInt"
      "[parsed_json][body][data][extendedTestBool]" => "extendedTestBool"
    }

    remove_field => [ "message", "parsed_json" ]
  }
}

image

Thanks!!

1 Like