CODEWITHSUNDEEP
jsonlogstash
Shawn Sim
Shawn Sim

Reputation: 555

Logstash json filter parsed fields cannot be read within logstash

I am parsing a json file with "codec => json" in the input and " json { source=>message }" in the filter.

I have also tried alternating the two.

The parsed fields cannot be read by logstash using "if [comment]". This will not work despite the being about to see the field with values with "stdout { codec => rubydebug }" as output

Upvotes: 0

Views: 139

Answers (1)

Shawn Sim
Shawn Sim

Reputation: 555

I just found out that the fields that I am trying to work with are actually sub fields. I was trying to access them like normal fields.

Upvotes: 0

Related Questions