0
votes

I am parsing a json file with "codec => json" in the input and " json { source=>message }" in the filter.

I have also tried alternating the two.

The parsed fields cannot be read by logstash using "if [comment]". This will not work despite the being about to see the field with values with "stdout { codec => rubydebug }" as output

1
Please share your current config and a sample log line, that will be easier to help you.Val

1 Answers

0
votes

I just found out that the fields that I am trying to work with are actually sub fields. I was trying to access them like normal fields.