Logstash Merge Field With Root Object

3
votes

I have logstash input that looks like this

{
    "@timestamp": "2016-12-20T18:55:11.699Z",
    "id": 1234,
    "detail": {
        "foo": 1
        "bar": "two"
    }
}

I would like to merge the content of "detail" with the root object so that the final event looks like this:

{
    "@timestamp": "2016-12-20T18:55:11.699Z",
    "id": 1234,
    "foo": 1
    "bar": "two"
}

Is there a way to accomplish this without writing my own filter plugin?

2
logstashlogstash-configuration

2 Answers

9
votes

You can do this with a ruby filter.

filter { ruby { code => " event['detail'].each {|k, v| event[k] = v } event.remove('detail') " } }

0
votes

There is a simple way to do that using the json_encode plugin (not included by default).

The json extractor add fields to the root of the event. It's one of the very few extractors that can add things to the root.

filter {
    json_encode {
        source => "detail"
        target => "detail"
    }

    json {
        source => "detail"
        remove_field => [ "detail" ]
    }
}