How can I add a nested json? All I can find is stuff about parsing json but I want to create one

I have a badly formatted message from a network device that I get from syslog. I’ve got a tidy little pipeline rule that gets it all formatted. But what I really want, and can’t figure out how to do is the following. Currently, without if/then logic in pipeline rules it takes a couple rules to mimic that logic. For each message, I process the whittle away at the message placing the remainder into a holding value for the next rule. So first we get the basic parts that come through common to all received messages:

when
  true
then

  let values = split(",", to_string($message.message), 4);
  let map = {
    interface:     values[0],
    packetid:  values[1],
    packettype:         values[2],
    };

  set_field("packet_properties", map);
  set_field("message", values[3]);
end

result:
{
   interface: blah,
   packetid: blah,
   packettype: IPv4
}

ok cool. So now in the NEXT rule, I will extract “message” and continue parsing it IF packettype == IPv4. But I want the new next set of values to end up looking like this:

{
   interface: blah,
   packetid: blah,
   packettype: IPv4,
   ipv4_properties: {
      TOS: xxx.
      TTL: xxxx,
      Flags: xxx
   }
}

For the life of me I can’t get anything like set_fields or anything to do that. Can I only make flat json in Graylog?

Im not following why you are trying to get multi level json, in graylog you are just ending up with fields, and fields in graylog are just a single level, there is no nesting.

What does the original message look like and how do you want the final message stored in graylog to look?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.