Need to convert string to JSON in LogStash

Question

I have logstash ingesting a log, in Json format, that has a specific field that contains JSON. Logstash is treating that specific field with JSON as a string since the value is quoted. I want Logstash to treat the contents of that field as JSON also, but can't figure out how to strip out the quotes.

here is the log: {"Time":"2014-06-16","Hostname":"FOOname","Event":"Warning","CustomField":"{"Title":"This is the data treated as a string","User":"FooUser"}"}

The quotes around the value of "CustomField" is causing the issue.

Thanks

Answer 1

What is your current config and what version of Logstash are you running?

I would assume the following would work:

filter {
  json {
    source => "CustomField"
    target => "CustomFieldParsed"
  }
}

http://logstash.net/docs/1.4.1/filters/json

If your JSON is in the Title field then

    source => "CustomField.Title"