How can convert a json nested string to json in logstash?

56 Views Asked by At

My string after json decode js:

"{\"@timestamp\":\"2022-09-27T10:14:49.082014+02:00\",\"@version\":1,\"host\":\"hieu-GF63-Thin-10SC\",\"message\":\"{\\\"command\\\":\\\"test:upload\\\",\\\"title\\\":\\\"Import success\\\",\\\"total_success\\\":10,\\\"total_fails\\\":0,\\\"log_message\\\":\\\"\\\"}\",\"type\":\"Datahub\",\"channel\":\"logstash.main\",\"level\":\"INFO\",\"monolog_level\":200,\"context\":{\"host\":{\"ip\":\"127.0.0.1\"}}}\n"

My logstash script is

udp {
    port => 5000
  }
}
filter{
   json { source => "message" }
}
output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "my-index"
    user => "elastic"
    password => "123456"
  }
}

My result in elastic

{
        "_index" : "my-index",
        "_id" : "PskDfoMBtWToAIWATogd",
        "_score" : 1.0,
        "_ignored" : [
          "event.original.keyword"
        ],
        "_source" : {
          "channel" : "logstash.main",
          "context" : {
            "host" : {
              "ip" : "127.0.0.1"
            }
          },
          "type" : "Datahub",
          "monolog_level" : 200,
          "message" : "{\"command\":\"test:upload\",\"title\":\"Import success\",\"total_success\":10,\"total_fails\":0,\"log_message\":\"\"}",
          "host" : "hieu-GF63-Thin-10SC",
          "level" : "INFO",
          "@timestamp" : "2022-09-27T08:14:49.082014Z",
          "@version" : 1,
          "event" : {
            "original" : "{\"@timestamp\":\"2022-09-27T10:14:49.082014+02:00\",\"@version\":1,\"host\":\"hieu-GF63-Thin-10SC\",\"message\":\"{\\\"command\\\":\\\"test:upload\\\",\\\"title\\\":\\\"Import success\\\",\\\"total_success\\\":10,\\\"total_fails\\\":0,\\\"log_message\\\":\\\"\\\"}\",\"type\":\"Datahub\",\"channel\":\"logstash.main\",\"level\":\"INFO\",\"monolog_level\":200,\"context\":{\"host\":{\"ip\":\"127.0.0.1\"}}}\n"
          }
        }
      }

How can I extract the value in message field into json data and append in _source For example, I want to command, total_success field append into _source

0

There are 0 best solutions below