Json file has array lists. list has more than one arrays and want to generate document id from object in array.
sample json
{data[
{mainCatName "cat1"
id 1
subCat[{
subcatId 32015,
subcatName "subcat11"},
{
subcatId 32016
subcatName "subcat12"}]},
{mainCatName "cat2",
id 2,
subCat[{
subcatId 32014,
subcatName "subcat21"},
{
subcatId 32012
subcatName "subcat22"}]}
]}
want to transfer as follows to ELK from logstash
id:1
mainCatName:cat1
subcatId:32015
subcatName :subcat11
id:1
mainCatName:cat1
subcatId:32016
subcatName :subcat12
id:2
mainCatName:cat2
subcatId:32014
subcatName :subcat21
id:2
mainCatName:cat2
subcatId:32012
subcatName :subcat22
following logstash gives only last object of list. want to know how totake other object as well
input {
file {
path => "/xxx.json"
start_position =>"beginning"
sincedb_path => "/dev/null"
}
}
filter{
json{
source => "message"}
split { field => "data" }
mutate {
add_field => {
category_ => "%{[data][mainCatName]}"
categoryid_ => "%{[data][id]}"}
}
ruby {
code => '
event.get("[data][subCat]").each {|k|
event.set("mainCatName" , event.get("category_"))
event.set("id" , event.get("categoryurl_"))
event.set("subcatId" , k["subcatId"])
event.set("subcatName" , k["subcatName"])
}
event.remove("[data][subCat]")
'
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200/"]
index => "category"
document_type => "category"
#}
stdout { codec => rubydebug }
}