Logstash - convert JSON to readable format - during logging to a file - json

Question

I have a Logstash configuration as given below:
input {
udp {
port => 5043
codec => json
}
}
output {
file {
path => "/logfile.log"
}
}
I am trying to log messages in the "logfile.log" which are more readable.
So if my input data is like {"attr1":"val1","attr2":"val2"}
I want to write it in the log as:
attr1_val1 | attr2_val2
Basically converting data from JSON to a readable format.
What should I be modifying in my Logstash configuration to do that?

Answer 1

The message_format option of the file output allows you to specify how each message should be formatted. If the keys of your messages are fixed and known you can simply do this:
output {
file {
message_format => "attr1_%{attr1} | attr2_%{attr2}"
...
}
}
To handle arbitrary fields you'll probably have to write some custom Ruby code using the ruby filter. The following filter, for example, produces the same results as above but doesn't require you to hardcode the names of the fields:
filter {
ruby {
code => '
values = []
event.to_hash.each { |k, v|
next if k.start_with? "#"
values << "#{k}_#{v.to_s}"
}
event["myfield"] = values.join(" | ")
'
}
}
output {
file {
message_format => "%{myfield}"
...
}
}