Define logstash's jdbc-input-plugin json message root object

I’m using jdbc-input-plugin to get some orders data and send it to a rabbitmq queue.
To make the json message compatible with the queue consuming system, I need to add a root named order.
I’m getting

{ "id" : 123, "price" : 12.50 }

and I need it to be

{ "order" : { "id" : 123, "price" : 12.50 } }

Is there any way I can inform the jdbc-input to use order as the default root for the message ?

I know I can achieve this with mutate filter like :

filter {
  mutate {
    add_field => {
      "[order][id]"     => "%{[id]}"
      "[order][price]"  => "%{[price]}"
    }

    remove_field => [ "id", "price" ]
  }
}

But I hope there’s a better way :wink:

No other way that I know of.
FYI. You can use add_field on the jdbc_input - it will run that function after the event is created.

If you have any other filter, just add the remove_field piece in it before the event hits the output section.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.