Trying to add prefix to key in logstash config, but without period

Elastic Stack Logstash
1

From a component I am working on, I get certain information in the log that is report information. This information comes as "ReportBody". However, I want to add a prefix to some of the information (i.e. NumberOfDevices} from ReportBody so it appears that way in Kibana. Therefore, in my logstash configuration, I have written:

json {
source => "ReportBody"
target => "someReport"
remove_field => ["ReportBody"]
}

The result in Kibana is "someReport.NumberofDevices": 3
This includes period between the target(prefix) and the key. What can I do to "mutate" it so that either the period is deleted or I can substitute it with underscore ("_")?

2

The ruby filter example in this post is pretty close to what you need: http://stackoverflow.com/a/28368575/414355

If you run Logstash 5 or later you need to use the new event API, but that's a simple conversion of the code above.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.