CODEWITHSUNDEEP
jsonelasticsearchlogstash
cybergoof
cybergoof

Reputation: 1437

Need to convert string to JSON in LogStash

I have Logstash ingesting a log, in JSON format. It has a specific field that contains JSON. Logstash is treating that specific field with JSON as a string since the value is quoted. I want Logstash to treat the contents of that field as JSON also, but can't figure out how to strip out the quotes.

Here is the log:

{"Time":"2014-06-16","Hostname":"FOOname","Event":"Warning","CustomField":"{"Title":"This is the data treated as a string","User":"FooUser"}"}

The quotes around the value of "CustomField" cause the issue.

Upvotes: 4

Views: 13740

Answers (1)

stuart-warren
stuart-warren

Reputation: 615

What is your current config and what version of Logstash are you running?

I would assume the following would work:

filter {
  json {
    source => "CustomField"
    target => "CustomFieldParsed"
  }
}

http://logstash.net/docs/1.4.1/filters/json

If your JSON is in the Title field then 

    source => "CustomField.Title"

Upvotes: 8

Related Questions