Logstash Merge Field With Root Object

Question

I have logstash input that looks like this

{
    \"@timestamp\": \"2016-12-20T18:55:11.699Z\",
    \"id\": 1234,
    \"detail\": {
        \"foo\": 1
                


        

Answer 1

You can do this with a ruby filter.

filter { ruby { code => " event['detail'].each {|k, v| event[k] = v } event.remove('detail') " } }

Answer 2

There is a simple way to do that using the json_encode plugin (not included by default).

The json extractor add fields to the root of the event. It's one of the very few extractors that can add things to the root.

filter {
    json_encode {
        source => "detail"
        target => "detail"
    }

    json {
        source => "detail"
        remove_field => [ "detail" ]
    }
}