JSON processor

edit

Converts a JSON string into a structured JSON object.

Table 28. Json Options

Name Required Default Description

field

yes

-

The field to be parsed.

target_field

no

field

The field that the converted structured object will be written into. Any existing content in this field will be overwritten.

add_to_root

no

false

Flag that forces the parsed JSON to be added at the top level of the document. target_field must not be set when this option is chosen.

add_to_root_conflict_strategy

no

replace

When set to replace, root fields that conflict with fields from the parsed JSON will be overridden. When set to merge, conflicting fields will be merged. Only applicable if add_to_root is set to true.

allow_duplicate_keys

no

false

When set to true, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins.

description

no

-

Description of the processor. Useful for describing the purpose of the processor or its configuration.

if

no

-

Conditionally execute the processor. See Conditionally run a processor.

ignore_failure

no

false

Ignore failures for the processor. See Handling pipeline failures.

on_failure

no

-

Handle failures for the processor. See Handling pipeline failures.

tag

no

-

Identifier for the processor. Useful for debugging and metrics.

All JSON-supported types will be parsed (null, boolean, number, array, object, string).

Suppose you provide this configuration of the json processor:

{
  "json" : {
    "field" : "string_source",
    "target_field" : "json_target"
  }
}

If the following document is processed:

{
  "string_source": "{\"foo\": 2000}"
}

after the json processor operates on it, it will look like:

{
  "string_source": "{\"foo\": 2000}",
  "json_target": {
    "foo": 2000
  }
}

If the following configuration is provided, omitting the optional target_field setting:

{
  "json" : {
    "field" : "source_and_target"
  }
}

then after the json processor operates on this document:

{
  "source_and_target": "{\"foo\": 2000}"
}

it will look like:

{
  "source_and_target": {
    "foo": 2000
  }
}

This illustrates that, unless it is explicitly named in the processor configuration, the target_field is the same field provided in the required field configuration.