Skip to content

Instantly share code, notes, and snippets.

@jordansissel
Created June 14, 2012 18:40
Show Gist options
  • Save jordansissel/2932087 to your computer and use it in GitHub Desktop.
Save jordansissel/2932087 to your computer and use it in GitHub Desktop.
logstash: pulling json from a message into the event itself
% ruby bin/logstash agent -e 'filter { grok { pattern => "^.*?\{%{GREEDYDATA:jsoninsides}\}" } mutate { replace => [ "jsoninsides", "{%{jsoninsides}}" ] } json { jsoninsides => "@fields" } mutate { remove => "jsoninsides" } } output { stdout { debug => true } }'
hello world { "foo": "bar", "super": 123.456 } blah blah blah
input { stdin { type => "stdin" } }
filter {
grok { pattern => "^.*?\{%{GREEDYDATA:jsoninsides}\}" }
mutate { replace => [ "jsoninsides", "{%{jsoninsides}}" ] }
json { jsoninsides => "@fields" }
mutate { remove => "jsoninsides" }
}
output { stdout { debug => true } }
{
"@source" => "stdin://pork/",
"@type" => "stdin",
"@tags" => [],
"@fields" => {
"foo" => "bar",
"super" => 123.456
},
"@timestamp" => "2012-06-14T18:41:09.165430Z",
"@source_host" => "pork",
"@source_path" => "/",
"@message" => "hello world { \"foo\": \"bar\", \"super\": 123.456 } blah blah blah"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment