How to `grok` the logstash formatted log in logstash?

[chintanp]

I am trying to write a filter for the logstash formatted log in logstash. The current message string is:

{"@message":"1 users connected","@timestamp":"2020-04-02T00:10:17.871Z","@fields":{"level":"info"}}

I tried using
else if [fields][log_type] == "city_dashboard_logs" { json { source => “message” target => “message” } }
but this did not work.

Any suggestions?

[c-vetter]

There is no magic to the format of logstash, it's simple JSON. There is no field log_type in your sample message, therefore you cannot filter on it. If you expect that, you need to find the reason it's missing. Please close this issue as there is nothing to be done within logform.

[chintanp]

@rasenplanscher Yes, thanks. Seems like a rookie mistake now.