Logstash Merge Field With Root Object

Question

I have logstash input that looks like this

{
    "@timestamp": "2016-12-20T18:55:11.699Z",
    "id": 1234,
    "detail": {
        "foo": 1
        "bar": "two"
    }
}

I would like to merge the content of "detail" with the root object so that the final event looks like this:

{
    "@timestamp": "2016-12-20T18:55:11.699Z",
    "id": 1234,
    "foo": 1
    "bar": "two"
}

Is there a way to accomplish this without writing my own filter plugin?

Answer 1

You can do this with a ruby filter.

filter { ruby { code => " event['detail'].each {|k, v| event[k] = v } event.remove('detail') " } }