Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion lib/logstash/filters/json.rb
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,12 @@ class LogStash::Filters::Json < LogStash::Filters::Base
# JSON in the value of the `source` field will be expanded into a
# data structure in the `target` field.
#
# The string in the `target` option may contain dynamic sprintf-style
# field references, i.e. the contents of one field can be used to choose
# the name of the target field. Dynamic field references can only refer
# to already existing fields, so the JSON string being parsed can't
# contain the name of the target field.
#
# NOTE: if the `target` field already exists, it will be overwritten!
config :target, :validate => :string

Expand Down Expand Up @@ -83,7 +89,7 @@ def filter(event)
end

if @target
event.set(@target, parsed)
event.set(event.sprintf(@target), parsed)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's room for confusion here that a user may want a value from the parsed object to dictate what field is set. If we're going to allow this behavior, I think we need to document what does and doesn't work for this plugin. Thoughts?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point @jordansissel! I think it'd be nice to support pulling a field from the parsed object, but how would that addressing even work since we also need to support indirect addressing based on existing fields?

I'm leaning towards keeping the existing behavior but documenting it (I forgot about that in this first version of the patch). Selecting the target field based on fields from the parsed object is possible via an extra mutate operation afterwards so we won't be blocking anything with this limitation. Sounds good to you?

else
unless parsed.is_a?(Hash)
@tag_on_failure.each{|tag| event.tag(tag)}
Expand Down
17 changes: 17 additions & 0 deletions spec/filters/json_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,23 @@
end
end

describe "parse message into a dynamically named target field" do
config <<-CONFIG
filter {
json {
# Parse message as JSON, store the results in the field named
# by the contents of the 'target' field'
source => "message"
target => "%{target}"
}
}
CONFIG

sample({"target" => "data", "message" => '{ "hello": "world" }'}) do
insist { subject.get("[data][hello]") } == "world"
end
end

describe "tag invalid json" do
config <<-CONFIG
filter {
Expand Down