Logstash Merge Field With Root Object

Question

I have logstash input that looks like this

{
    "@timestamp": "2016-12-20T18:55:11.699Z",
    "id": 1234,
    "detail": {
        "foo": 1
        "bar": "two"
    }
}

I would like to merge the content of "detail" with the root object so that the final event looks like this:

{
    "@timestamp": "2016-12-20T18:55:11.699Z",
    "id": 1234,
    "foo": 1
    "bar": "two"
}

Is there a way to accomplish this without writing my own filter plugin?

Answer 1

You can do this with a ruby filter.

filter { ruby { code => " event['detail'].each {|k, v| event[k] = v } event.remove('detail') " } }

Answer 2

There is a simple way to do that using the json_encode plugin (not included by default).

The json extractor add fields to the root of the event. It's one of the very few extractors that can add things to the root.

filter {
    json_encode {
        source => "detail"
        target => "detail"
    }

    json {
        source => "detail"
        remove_field => [ "detail" ]
    }
}