Skip to main content

How do you deal with nested JSON when creating a parser?

  • September 3, 2023
  • 2 replies
  • 33 views

Forum|alt.badge.img+4

How do you deal with nested JSON when creating a parser? I see that JSON filter does not support nested JSON.

2 replies

Forum|alt.badge.img+6
  • Bronze 2
  • September 3, 2023

Can you do something like this:

json {
source => "protoPayload.blah.nestedJsonField"
on_error => "not_json_nestedJsonField"
array_function => "split_columns"
target => "nestedJsonField"
} Then just reference values off nestedJsonField (or whatever you rename your target to) as you would normally?


Forum|alt.badge.img+4
  • Author
  • New Member
  • September 3, 2023

I will try that, this is my first parser. Thank you, any help is appreciated