CODEWITHSUNDEEP
jsonlogstash
javapenguin
javapenguin

Reputation: 1036

Logstash json field convert

Logstash is receiving a json input from filebeat. It then parses the json.

filter {
  json {
    source => "message"
    target => "data"
  }
}

This data then goes to elastic search. All which works perfectly.

Now I need to convert some of the json fields.

e.g. data.body_bytes_sent must be converted to an integer.

I know there is a convert in logstash which converts fields:

filter {
  mutate {
    convert => { "msgSubmissionTime" => "integer" }
  }
}

But how do I tell it to convert a field in the parsed json object?

Upvotes: 1

Views: 1933

Answers (1)

javapenguin
javapenguin

Reputation: 1036

This worked:

filter {
  json {
    source => "message"
    target => "data"
  }
  mutate {
    convert => {"[data][body_bytes_sent]" => "integer"}
    convert => {"[data][bytes_sent]" => "integer"}
  }
}

Upvotes: 1

Related Questions