logstash parse dynamically json to add new fields in the output

Question

I have the following JSON INPUT:

{
    "ts": "1459504800000",
    "data": "30.7",
    "sid": "1"
}

Whit this filter:

filter {
    mutate {
            convert => { 
            "data" => "float"
            "ts" => "integer" 

        }

    }

    date { 
        match => [ "ts", "UNIX_MS"]
            target => "ts_date"
    }
}

I get the following result:

{
            "ts" => 1459504800000,
          "data" => 30.7,
           "sid" => "1",
      "@version" => "1",
    "@timestamp" => "2016-04-21T14:29:54.241Z",
          "type" => "redis-input",
       "ts_date" => "2016-04-01T10:00:00.000Z"
}

I would like to add a new field in the result composed dynamically with "data" and "sid" parameters values (1 and 30.7) of the input. This field should be somthing like "somestring"+"1" => 30.7

Thanks!

Alain Collins · Accepted Answer · 2016-04-21 16:00:39Z

1

This is what add_field is for. For tasks like this that are unrelated to other filters, I'd use it in mutate:

mutate {
    add_field => { "something%{sid}" => "%{data}" }
}

The value would be a string at this point. If you want it to be numeric, you'd need a second mutate using the convert function.

answered Apr 21, 2016 at 16:00

Alain Collins

16.4k2 gold badges34 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

JosepB Over a year ago

Thanks @Alain. Do you know how could I parse the data type of the "%{data}" to float?

Alain Collins Over a year ago

Yes, "If you want it to be numeric, you'd need a second mutate using the convert function."

JosepB Over a year ago

Something like mutate { convert => { "something%{sid}" => "float"}}?

Collectives™ on Stack Overflow

logstash parse dynamically json to add new fields in the output

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related