Wrap logstash information into another object

We're performing Elasticsearch updates with scripts and upserts and we want to wrap everything in the Logstash filter into another object.

Take for instance:

grok {
  patterns_dir => "/etc/logstash/grok_patterns"
  break_on_match => false
  match =>  {
    "message" => [

We would like to be able to grab this entire message + filebeat data and put this into an object. This object then would be sent to Elasticsearch like this:

  "events": {
    "Foo": "bar"
    "beats": {
      "host": "foo.domain.com"

How would we go about this?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.