Filter alert

[Enteee]

The idea is to write a packet filter for logstash which operates on json data.
The following configuration explains what this filter plugin does:

filter { 
     jqfilter {
         filter => [
             ' Json query string ' , rule uuid
         ]
         target => "field name"
     }
}

this plugin matches the Json query string against the json representation of the event and if matched adds the rule uuid to the field specified with target.

[Enteee]

possible query languages:
http://stackoverflow.com/questions/777455/is-there-a-query-language-for-json

[noeleont]

logstash json filter plugin is integrated