Can you do something like this:




json {


source => "protoPayload.blah.nestedJsonField"


on_error => "not_json_nestedJsonField"


array_function => "split_columns"


target => "nestedJsonField"


}
Then just reference values off nestedJsonField (or whatever you rename your target to) as you would normally?

I will try that, this is my first parser. Thank you, any help is appreciated