# Access information inside an object

**URL:** <https://discuss.elastic.co/t/access-information-inside-an-object/123922>\
**Category:** Logstash\
**Created:** [March 14, 2018, 2:26pm UTC](https://discuss.elastic.co/t/access-information-inside-an-object/123922 "2018-03-14T14:26:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bkaderlof](https://avatars.discourse-cdn.com/v4/letter/b/f475e1/32.png) [@bkaderlof](https://discuss.elastic.co/u/bkaderlof)\
**Post date:** [March 14, 2018, 2:26pm UTC](https://discuss.elastic.co/t/access-information-inside-an-object/123922/1 "2018-03-14T14:26:22Z")

</div>

i'm having trouble accessing data inside an object, this is the original input

{  
"L4\_DST\_PORT" =\> 10082,  
"IN\_PKTS" =\> 4115,  
"SRC\_IP\_LOCATION" =\> [  
[0] -84.497803,  
[1] 38.0462  
],  
"DST\_IP\_LOCATION" =\> [  
[0] 0.0,  
[1] 0.0  
],  
"L7\_PROTO" =\> 87,  
"json" =\> {  
"MAX\_TTL" =\> "40",  
"RTP\_OUT\_MOS" =\> "440",  
"SRC\_TOS" =\> "184",  
"ICMP\_TYPE" =\> "0",  
"RTP\_MOS" =\> "440",  
"MIN\_TTL" =\> "40",  
"RTP\_OUT\_JITTER" =\> "34",  
"RTP\_IN\_MOS" =\> "440",  
"57943" =\> "172.23.0.157",  
"RTP\_IN\_JITTER" =\> "42"  
},  
"@timestamp" =\> 2018-03-14T14:21:06.141Z  
}

i'm only interested on the fields inside the "json" object, however i don't know to access that information.

let's say i want to use the RTP\_MOS and use it on the http output as a dynamic variable, how i can access that field???

thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 14, 2018, 2:42pm UTC](https://discuss.elastic.co/t/access-information-inside-an-object/123922/2 "2018-03-14T14:42:05Z")

</div>

You're probably looking for `%{[json][RTP_IN_MOS]}`.

---

<div class="post-metadata">

**Author:** ![bkaderlof](https://avatars.discourse-cdn.com/v4/letter/b/f475e1/32.png) [@bkaderlof](https://discuss.elastic.co/u/bkaderlof)\
**Post date:** [March 14, 2018, 3:08pm UTC](https://discuss.elastic.co/t/access-information-inside-an-object/123922/3 "2018-03-14T15:08:14Z")

</div>

seems very logical, however it dind't work.

i receive this error message:

JSON: The returned JSON does not match the expected structure ('%{[json). (code: PE231)RTP\_IN\_MOS]}' is not a valid integer value]

when i use other variable on the main message not inside "json" object it works perfectly, like  
"%{L4\_DST\_PORT}" it works fine

is there any way to transform that object into a flat information, i mean extract all the information inside the "json" object

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 14, 2018, 7:08pm UTC](https://discuss.elastic.co/t/access-information-inside-an-object/123922/4 "2018-03-14T19:08:19Z")

</div>

What does your configuration look like?

> is there any way to transform that object into a flat information, i mean extract all the information inside the "json" object

You can move (rename) the fields with a mutate filter. If you don't have a fixed list of field names you can bulk-rename them with a ruby filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 11, 2018, 7:08pm UTC](https://discuss.elastic.co/t/access-information-inside-an-object/123922/5 "2018-04-11T19:08:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.