I have the following log. Field - The data is treated as a string.
{"host":"1.1.1.1","instance":15665,"type":"info","name":"info","@timestamp":"2022-08-29T08:59:42.200Z","data":"{\n url: 'https://site.scom/data/rest/getOrderStatusExtended.do',\n method: 'POST',\n request: {\n body: {\n orderId: '54d7bd05-6606-728c-ab10-550102999aef',\n userName: '8072-apikey',\n password: '******************'\n },\n
headers: {\n 'user-agent': 'got (https://github.com/sindresorhus/got)',\n 'content-type': 'application/x-www-form-urlencoded',\n accept: 'application/json',\n 'content-length': '104',\n
'accept-encoding': 'gzip, deflate, br'\n }\n },\n response: {\n
body: {\n errorCode: '0',\n errorMessage: 'no',\n
orderNumber: '630c7f975fcee8de1d944c84',\n orderStatus: 1,\n
actionCode: 0,\n actionCodeDescription: '',\n amount: 162279,\n currency: '643',\n date: 1661763479843,\n
orderDescription: 'dsdsdsdsd',\n ip: '2.2.2.2',\n
merchantOrderParams: [\n { name: 'binProductCategory', value: 'DEBIT' },\n { name: 'binProductCode', value: 'N' },\n...
And of course I can't access the fields, but I really wanted to. Can you tell me if it's possible to convert a string to a dictionary?
mutate {
add_field => {"url" => "%{[data][url]}"}
}
Or how to get the url field from the data field?