|
@@ -1510,15 +1510,72 @@ Converts a JSON string into a structured JSON object.
|
|
| `add_to_root` | no | false | Flag that forces the serialized json to be injected into the top level of the document. `target_field` must not be set when this option is chosen.
|
|
| `add_to_root` | no | false | Flag that forces the serialized json to be injected into the top level of the document. `target_field` must not be set when this option is chosen.
|
|
|======
|
|
|======
|
|
|
|
|
|
|
|
+Suppose you provide this configuration of the `json` processor:
|
|
|
|
+
|
|
|
|
+[source,js]
|
|
|
|
+--------------------------------------------------
|
|
|
|
+{
|
|
|
|
+ "json" : {
|
|
|
|
+ "field" : "string_source",
|
|
|
|
+ "target_field" : "json_target"
|
|
|
|
+ }
|
|
|
|
+}
|
|
|
|
+--------------------------------------------------
|
|
|
|
+
|
|
|
|
+If the following document is processed:
|
|
|
|
+
|
|
|
|
+[source,js]
|
|
|
|
+--------------------------------------------------
|
|
|
|
+{
|
|
|
|
+ "string_source": "{\"foo\": 2000}"
|
|
|
|
+}
|
|
|
|
+--------------------------------------------------
|
|
|
|
+
|
|
|
|
+after the `json` processor operates on it, it will look like:
|
|
|
|
+
|
|
[source,js]
|
|
[source,js]
|
|
--------------------------------------------------
|
|
--------------------------------------------------
|
|
{
|
|
{
|
|
- "json": {
|
|
|
|
- "field": "{\"foo\": 2000}"
|
|
|
|
|
|
+ "string_source": "{\"foo\": 2000}",
|
|
|
|
+ "json_target": {
|
|
|
|
+ "foo": 2000
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
--------------------------------------------------
|
|
|
|
|
|
|
|
+If the following configuration is provided, omitting the optional `target_field` setting:
|
|
|
|
+[source,js]
|
|
|
|
+--------------------------------------------------
|
|
|
|
+{
|
|
|
|
+ "json" : {
|
|
|
|
+ "field" : "source_and_target"
|
|
|
|
+ }
|
|
|
|
+}
|
|
|
|
+--------------------------------------------------
|
|
|
|
+
|
|
|
|
+then after the `json` processor operates on this document:
|
|
|
|
+
|
|
|
|
+[source,js]
|
|
|
|
+--------------------------------------------------
|
|
|
|
+{
|
|
|
|
+ "source_and_target": "{\"foo\": 2000}"
|
|
|
|
+}
|
|
|
|
+--------------------------------------------------
|
|
|
|
+
|
|
|
|
+it will look like:
|
|
|
|
+
|
|
|
|
+[source,js]
|
|
|
|
+--------------------------------------------------
|
|
|
|
+{
|
|
|
|
+ "source_and_target": {
|
|
|
|
+ "foo": 2000
|
|
|
|
+ }
|
|
|
|
+}
|
|
|
|
+--------------------------------------------------
|
|
|
|
+
|
|
|
|
+This illustrates that, unless it is explicitly named in the processor configuration, the `target_field`
|
|
|
|
+is the same field provided in the required `field` configuration.
|
|
|
|
+
|
|
[[kv-processor]]
|
|
[[kv-processor]]
|
|
=== KV Processor
|
|
=== KV Processor
|
|
This processor helps automatically parse messages (or specific event fields) which are of the foo=bar variety.
|
|
This processor helps automatically parse messages (or specific event fields) which are of the foo=bar variety.
|