Access nested JSON Field in Logstash

Question

I have a Problem with accessing a nested JSON field in logstash (latest version).

My config file is the following:

input {
  http {
    port => 50         


        

Answer 1

I found a solution. Credits go to jpcarey (Elasticsearch Forum)

I had to remove codec => "json". That leads to another data structure. statements is now an array and not an object. So I needed to change %{[statements][authority][name]} to %{[statements][0][authority][name]}. That works without problems.

If you follow the given link you'll also find an better implementation of my mutate filters.