Handling nested JSON in an extension parser

The first problem is your JSON you shared is not valid JSON, so I will use the following example instead.

Assuming we have the following JSON event...

{
   "resource":{
      "type":"k8s_container",
      "labels":{
         "container_name":"test-container",
         "namespace_name":"default",
         "location":"us-west1-a",
         "project_id":"abc-123",
         "cluster_name":"test-cluster",
         "pod_name":"test-pod-123"
      }
   }
}

We can use a for loop and the `map` keyword to iterate over the key-value pairs.

filter {
  json {
    source => "message"
    on_error => "json_failure
    array_function => "split_columns"
  }
  for key, value in resource.labels map {
    mutate {
      replace => {
        "test.key" => "%{key}"
        "test.value" => "%{value}"
      }
    }
  statedump {}
  }
}

This would loop through all of the key-value pairs inside the `resource.labels` dict giving us the following key-value pairs at each iteration that can then be used to set the UDM fields.

1st Iteration
"key": "cluster_name",
"value": "test-cluster"

2nd Iteration
"key": "container_name",
"value": "test-container"

3rd Iteration
"key": "location",
"value": "us-west1-a"

etc...

If we wanted to do the same thing inside of a nested object, we can use a nested for loop and map such as in this example.

JSON event:

{
   "resource":{
      "type":"k8s_container",
      "labels":{
         "container_name":"test-container",
         "namespace_name":"default",
         "location":{
            "code":"us-west1-a",
            "country":"US"
         },
         "cluster_name":"test-cluster",
         "pod_name":"test-pod-123"
      }
   }
}

Parser code:

filter {
  json {
    source => "message"
    on_error => "json_failure
    array_function => "split_columns"
  }
  for key, value in resource.labels map {
    mutate {
      replace => {
        "test.key" => "%{key}"
      }
    }
    mutate {
      replace => {
        "test.value" => "%{value}"
      }
      on_error => "nested_key"
    }
    if [test][key] == "location" {
      for nestedKey, nestedValue in value map {
        mutate {
          replace => {
            "locationLabel.key" => "%{nestedKey}"
            "locationLabel.value" => "%{nestedValue}"
          }
        }
        statedump {}
      }
    }
  }
}