Wrap Json message in filter

I have log entries like

{"timeMillis":1545209409013,"thread":"ajp-bio-9003-exec-10","level":"INFO","loggerName":"com.company.Class","message":"Timeslot ID: null","endOfBatch":false,"loggerFqcn":"com.company.MyLogger","threadId":165,"threadPriority":5}

Filebeat is configured with fields_under_root: true and it is shipping the json logs to LS

LS is filtering the log message and passing it to ES via

filter {
  json {
    source => message
  }
}

The different fields (timemillis, thread, ..) are being added under root.
I would like now to prepend them with something like myApp. (myApp.timemillis, etc)

How can I achieve this? Should I better do it in LS filters or is it possible to do it at Filebeat level?

I have solved with this

  json {
    id => "log"
    source => message
    target => log
    remove_field => ["message"]
  }
  mutate {
    rename => { "log" => "[app][log]" }
  }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.