Скачать или смотреть How to Check Key Value Pair in JSON String for message Field in Logstash

Learn how to manipulate JSON strings in Logstash, specifically how to check key-value pairs and replace values in log processes.
---
This video is based on the question https://stackoverflow.com/q/68686349/ asked by the user 'user3460330' ( https://stackoverflow.com/u/3460330/ ) and on the answer https://stackoverflow.com/a/68716732/ provided by the user 'JBone' ( https://stackoverflow.com/u/4969849/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: How to check key value pair in json string for message field in logstash

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Understanding JSON Processing in Logstash

If you are working with Logstash and handling logs that contain JSON strings, you might encounter a situation where you need to check key-value pairs within these strings. One such common scenario is when these JSON strings are nested inside a message field, and you want to extract specific values from them.

In this guide, we will address this problem by guiding you through the process of checking the logplane value based on conditions derived from the extra_data field within your logs.

The Problem

You have a JSON log entry structured like this:

[[See Video to Reveal this Text or Code Snippet]]

You want to change the logplane value based on whether the nested log_plane field under extra_data.manager equals alarmlogs. To achieve this, follow the comprehensive steps outlined below.

The Solution

To manipulate the JSON string in your message field, you will need to perform the following steps using Logstash's filter configuration.

Step 1: Use the JSON Filter

First, you need to convert the message string into a JSON object so that Logstash can process its fields. You will accomplish this by incorporating the json filter in your Logstash configuration.

Below is how you will set this up:

[[See Video to Reveal this Text or Code Snippet]]

Step 2: Define the Conditional Logic

Now that you have your JSON object, you can use conditional statements to check the value of logplane in the nested structure. Depending on whether this field equals alarmlogs, you will then proceed to replace the logplane value.

Here’s how to implement this:

[[See Video to Reveal this Text or Code Snippet]]

Complete Filter Configuration

Putting everything together, your final Logstash filter configuration will look like this:

[[See Video to Reveal this Text or Code Snippet]]

Step 3: (Optional) Convert Back to JSON

You may want to consider whether you need to convert your updated fields back into a JSON format. Depending on your use case, you can utilize the json filter again to serialize the object.

Conclusion

By following the steps outlined above, you can effectively check and manipulate key-value pairs within JSON strings in Logstash. With the json filter and conditionals, you can make the necessary adjustments to your logs based on their contents, ensuring that your data processing needs are met.

Feel free to experiment with this setup to tailor it further to your specific logging requirements!