CODEWITHSUNDEEP
logstashlogstash-configuration
tamizhgeek
tamizhgeek

Reputation: 1401

logstash mutate filter always stringifies hash and array

I have a json log file, which I am taking as a input with this config

input {
   file { filename }
   codec { json_lines }
}

Each line is a deeply nested JSON.

In the filters,

When I say 

mutate { add_field => { "new_field_name" => "%{old_field_name}"}

Upvotes: 1

Views: 1367

Answers (1)

hurb
hurb

Reputation: 2217

You might consider using the ruby filter to duplicate the array:

filter  {
    ruby { code => "event['newhash'] = event['myhash']" }
}

I don't think there is a cleaner solution.

Apart from that, do you really use the json_lines codec with the file input? From logstash doc:

Do not use this codec if your source input is line-oriented JSON, for example, redis or file inputs. Rather, use the json codec.

Upvotes: 3

Related Questions