Trying to access nested json in logstash mutate filter

[vtst2412 (Vincent Tran)]

I'm trying to do something similar to this:

1. pipe the content of "message" to a new field "raw"
2. Add new fields by accessing the nested content inside of the original raw data
3. The fat lady sings?

Not quite. rubydebug output looks fine, but when I switch over to ES output, the fields do not resolve as expected.

New fields resolve as expected in stdout output but not in elasticsearch output

input { file { type => "json" path => "/home/user/json/test.json" #codec => json start_position => "beginning" sincedb_path => "/dev/null" } } filter { json { source => "message" target => "raw" add_field => { "Name" => "%{[raw][0][content][0][data][Name]}" "Issues" => "%{[raw][0][content][0][data][Issues]}" "Serial" => "%{[raw][0][content][0][data][Serial]}" "Model" => "%{[raw][0][content][0][data][Model]}" "…

Did you encounter this problem?