We want to use a Json key in the condition section of the parser extension, the key is "agent.googleapis.com/log_file_path".

for example

if [labels][compute][googleapis][com/resource_name] != "" {
the json looks like this:

{
"insertId": "<someID>",
"jsonPayload": {
"message": "Feb 23 0 <someData>"
},
"labels": {
"agent.googleapis.com/log_file_path": "/some/path/logfile.log",
"compute.googleapis.com/resource_name": "<someName>"
},
...

...
}

Does anyone know how to do this?

Data Extraction works fine with it:

mutate {
replace => {
"event1.idm.read_only_udm.principal.hostname" => %{labels.compute.googleapis.com/resource_name}"
}
}