Get only nested JSON in Logstash

Question

How can I get only nested json in Logstash?

{
    "metadata_1":"Meta 1",
    "metadata_2":"Meta 2",
    ...
    "metadata_N":"Meta N",
    "mydata":{
        "name":"User Name 1",
        "surname":"User SurName 1"
    }
}

I want to get only "mydata". All "metadata" must be completely removed from the result. Logstash config:

input {
    stdin { }
}
filter {
    json {
       source => "message"
    }
}
output {
    stdout { codec => rubydebug }
}

Not worked for me:

source => "message"
source => "mydata"
source => "[message][mydata]"

The expected result is ("mydata" as root):

{
    "name":"User Name 1",
    "surname":"User SurName 1"
}

Alcanzar · Accepted Answer · 2017-05-25 18:38:03Z

1

The prune filter should do what you want:

 prune {
   whitelist_names => ["mydata"]
 }

answered May 25, 2017 at 18:38

Alcanzar

17.2k7 gold badges45 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Dmitry Over a year ago

Thanks. That is mostly close to what I'm looking for. But I see that result is not in root, but as "mydata" object. And "prune" does not have "target" field. And chain json filter just after "prune" like: json { source => "mydata" } has no effect.

Dmitry Over a year ago

Cool! Thanks . .

Collectives™ on Stack Overflow

Get only nested JSON in Logstash

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related