Skip to content
Merged
Changes from 3 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 59 additions & 9 deletions docs/reference/ingest/ingest-node.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -1510,32 +1510,83 @@ Converts a JSON string into a structured JSON object.
| `add_to_root` | no | false | Flag that forces the serialized json to be injected into the top level of the document. `target_field` must not be set when this option is chosen.
|======

Suppose you provide this configuration of the `json` processor:

[source,js]
--------------------------------------------------
{
"json" : {
"field" : "string_source",
"target_field" : "json_target"
}
}
--------------------------------------------------

If the following document is processed:

[source,js]
--------------------------------------------------
{
"string_source": "{\"foo\": 2000}"
}
--------------------------------------------------

after the `json` processor operates on it, it will look like:

[source,js]
--------------------------------------------------
{
"string_source": "{\"foo\": 2000}",
"json_target": {
"foo": 2000
}
}
--------------------------------------------------

If the following configuration is provided, omitting the optional `target_field` setting:
[source,js]
--------------------------------------------------
{
"json": {
"field": "{\"foo\": 2000}"
"json" : {
"field" : "source_and_target"
}
}
--------------------------------------------------

then after the `json` processor operates on this document:

[source,js]
--------------------------------------------------
{
"source_and_target": "{\"foo\": 2000}"
}
--------------------------------------------------

it will look like:

[source,js]
--------------------------------------------------
{
"source_and_target": {
"foo": 2000
}
}
--------------------------------------------------

This illustrates that, unless it is explicitly named in the processor configuration, the `target_field`
is the same field provided in the required `field` configuration.

[[kv-processor]]
=== KV Processor
This processor helps automatically parse messages (or specific event fields) which are of the foo=bar variety.

For example, if you have a log message which contains `ip=1.2.3.4 error=REFUSED`, you can parse those automatically by configuring:


Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need to restore all the relevant markup around the examples in the kv processor.

[source,js]
--------------------------------------------------
{
"kv": {
"field": "message",
"field_split": " ",
"value_split": "="
}
}
--------------------------------------------------

[[kv-options]]
.Kv Options
Expand All @@ -1550,7 +1601,6 @@ For example, if you have a log message which contains `ip=1.2.3.4 error=REFUSED`
| `ignore_missing` | no | `false` | If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
|======


[[lowercase-processor]]
=== Lowercase Processor
Converts a string to its lowercase equivalent.
Expand Down