0.4 – i’m trying to make the value of /message become the whole body of the json. I’ve tried updateattribute, updaterecord, groovyscript. I cannot find a good example of this anywhere.
my snipped json looks like this, I’m happy about all other fields being lost.
{
"@timestamp": "2024-07-29T10:01:33.774Z",
...
"message": "{"Heap_Occupancy":68.54,"Thread_Count":95,"monitoringType":"JVMHealth","@timestamp":"2024\/07\/29 10:01:31","Subsystem_Type":"CICS","Job_Name":"TQCL01","Threads_Blocked":0,"region":"TQCL01","GCs_per_Minute":0.0}",
"input": {
"type": "log"
}
}
can anyone help me with how to do this?