Cannot access nested JSON object through filters


There seems to be no way for me to access a dynamic field through the %{field} notation when I have an object in my logs.

For example, if my log had a format similar to this:

Every time I try and access anything inside the events object all that I get returned is something similar to this:

the line in my config:

and the result:

I've tried several different approaches, and nothing seems to work. However, if I remove the object, it works fine.

Is my syntax wrong, or this unsupported?


Logstash Developers


Luke Rossy

Fix versions