Logstash Checking Existence of & Parsing Sub-Field

Question

In Logstash I have a JSON payload which I've decoded like so:

filter 
{ 
   json 
   { 
     source => "payload" 
     target => "payloadData" 
   }
}

Now I want to check if payloadData._extraData exists, and then deserialise that too.

I've tried this method, working from the example given in this related question:

filter 
{ 
   json 
   { 
     source => "payload" 
     target => "payloadData" 
   }
   if [payloadData._extraData] =~ /.+/ 
   { 
       sourcce => "payloadData._extraData"  
       target => "payloadData.extraData" 
   } 
}

But it doesn't do anything (no crash, no error message, just doesn't do anything)

hurb · Accepted Answer · 2015-09-02T09:58:48.687

The correct syntax is:

if [payloadData][_extraData] =~ /.+/   { }

Example input:

{"foo":"bar","spam":"eggs","abc":"xyz","one":"two","three":"four","five":"six","seven":{"eight":"nine"}}

Config:

filter {
    json { source => message }
    if [seven][eight] =~ /.+/ {
        # do something
    }
}

Apart from that, the code inside your if statement doesn't do anything. You need to specify a filter that should be executed. e.g.:

if [payloadData][_extraData] =~ /.+/  { 
   json {
       source => "payloadData[_extraData]"  
       target => "payloadData[extraData]" 
   }
}

What do you want to deserialize in your if statement? The first json filter should recognize nested objects.

Ah, awesome - thanks. I'll give that a shot. The reason I need the second deserialisation is because it's a message that contains another serialised message. So like ``{"extraData":"{\"bar\":\"baz\"}"}`` — , Sep 02 '15 at 14:16

Logstash Checking Existence of & Parsing Sub-Field

1 Answers1