Decompose Logstash json message into fields

logstash

Solution

Try the latest logstash 1.2.1 and use codec value to parse json events directly.

input {
    file {
        type => "tweetfile"
        path => ["/home/nikhil/temp/feed/*.txt"]
        codec => "json"
    }
}
filter{
    json{
        source => "message"
        target => "tweet"
    }
}
output {
    stdout { }
    elasticsearch { embedded => true }
}

Problem

It have a logfile that stores event with a timestamp and a json message. For example: timestamp {"foo": 12, "bar": 13} I would like to decompose the keys (foo and bar) in the json part into fields in the Logstash output. I'm aware that I can set the format field in the Logstash file filter to json_event but in that case I have to include the timestamp in json. There is also a json filter, but that adds a single field with the complete json data structure, instead of using the keys. Any ideas how this can be done?

Original source