Home > database >  logstash parse json child element, format and insert into elasticsearch
logstash parse json child element, format and insert into elasticsearch

Time:08-19

I have a json file like this:

  "fruits": {
    "fruit": [
      {
        "id": 1,
        "label": "test",
        "tag": "fine",
        "start": "4",
        "end": "9"
      },
      {
        "id": 2,
        "label": "test1",
        "tag": "fine1",
        "start": "2",
        "end": "4"
      }
    ]
  }
}

I have 100s of elements inside "fruit" field. I want to:

  • insert only the elements inside "fruit" field to the elasticsearch each as an individual doc. I want to use their own id as elasticsearch doc id.
  • calculate numbers in between "start" and "end" fields, then add those numbers as a comma separated string to a new field inside each doc.

The docs I want to insert into elasticsearch will be as follows:

{
    {
        "_index" : "my_index",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 1.0,
        "_source" : {
            "id" : "1",
            "label": "test",
            "tag": "fine",
            "start": "4",
            "end": "9",
            "diffs": "4,5,6,7,8,9"
        }
    },
    {
        "_index" : "my_index",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 1.0,
        "_source" : {
            "id" : "2",
            "label": "test1",
            "tag": "fine1",
            "start": "2",
            "end": "4",
            "diffs": "2,3,4"
        }
    }
}

Can anyone help me with the logstash configuration file to achieve the desired output? I am using ELK version 7.x

Thanks

CodePudding user response:

Finally I could solve the requirement following this instruction.

https://discuss.elastic.co/t/logstash-parse-json-child-element-format-and-insert-into-elasticsearch/312230/7

  • Related