Logstash Merge Field With Root Object

Question

I have logstash input that looks like this

{
    \"@timestamp\": \"2016-12-20T18:55:11.699Z\",
    \"id\": 1234,
    \"detail\": {
        \"foo\": 1
                


        

Answer 1

You can do this with a ruby filter.

filter { ruby { code => " event['detail'].each {|k, v| event[k] = v } event.remove('detail') " } }