logstash输入json删除根以进行Elasticsearch索引编制

Question

Here is the json structure coming out from my input.

"path" => "my/path",
    "@timestamp" => 2017-09-28T07:54:25.482Z,
      "@version" => "1",
          "host" => "linuxbox",
       "message" => "{\"top_val\":{\"birthday\":\"07/12/1991\",\"country\":\"India\"}"

Once i index this data to elasticsearch , i need to access this field in _source as top_val.birthday . How can i remove this top_val so that i can access the fields directly from _source. I know this can be done with arbitrary ruby code. But i believe there must be better ways to do it. Please help me with this.

Answer 1

放入ruby，在top_val所有字段之间循环，并将其移至事件的根。