# Add\_field with json codec

**URL:** <https://discuss.elastic.co/t/add-field-with-json-codec/41411>\
**Category:** Logstash\
**Created:** [February 10, 2016, 5:46pm UTC](https://discuss.elastic.co/t/add-field-with-json-codec/41411 "2016-02-10T17:46:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)\
**Post date:** [February 10, 2016, 5:46pm UTC](https://discuss.elastic.co/t/add-field-with-json-codec/41411/1 "2016-02-10T17:46:30Z")

</div>

Hi,

I'm working with json files and using the json codec to get at the values in each document. So far so good.

I now need to add some new fields to the document which will contain values taken from nested json.

For example I have:

```
if [outernode][timeoutvalue] {
			mutate {
				add_field => { "timeout" => "%{[outernode][timeoutvalue]}" }
			}
		}

```

Which does not work... All I want to do is create a new field called "timeout" and populate it with the value found in the [outernode][timeoutvalue] field which already exists. Ultimately I would be removing the [outernnode] field entirely... but only after I have decanted all the interesting values out of it and into new fields... If that makes sense.

How can I "get at" those nested values for use in add\_field?

Thanks!

UPDATE:

This seems to work okay:

add\_field =\> { "timeout" =\> "%{outernode[timeoutvalue]}" }

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 10, 2016, 6:42pm UTC](https://discuss.elastic.co/t/add-field-with-json-codec/41411/2 "2016-02-10T18:42:39Z")

</div>

> add\_field =\> { "timeout" =\> "%{outernode[timeoutvalue]}" }

That's not supposed to work. The syntax you originally used is the correct one, assuming your event looks like this:

```javascript
{
  "outernode": {
    "timeoutvalue": 123
  }
}

```

---

<div class="post-metadata">

**Author:** ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)\
**Post date:** [February 10, 2016, 8:49pm UTC](https://discuss.elastic.co/t/add-field-with-json-codec/41411/3 "2016-02-10T20:49:53Z")

</div>

Thanks inside the outernode there are up to forty unique entries, each with a value of its own. What I am trying to do is get those fields and values out of the outernode structure and make new fields for them. Then remove the outernode field completely. This will dramatically reduce the weight of the document that I send to ES.

Not sure why my original syntax would not work. Just glad that the latter syntax does appear to work okay.

Thanks again Magnus

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 11, 2016, 6:49am UTC](https://discuss.elastic.co/t/add-field-with-json-codec/41411/4 "2016-02-11T06:49:49Z")

</div>

If you want to move all subfields into the top level (effectively simply removing the `outernode` level) have a look at [Help parsing nested JSON with dynamic top key](https://discuss.elastic.co/t/help-parsing-nested-json-with-dynamic-top-key/41069).

---

<div class="post-metadata">

**Author:** ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)\
**Post date:** [February 11, 2016, 9:49am UTC](https://discuss.elastic.co/t/add-field-with-json-codec/41411/5 "2016-02-11T09:49:28Z")

</div>

Hi Magnus,

Thanks for the pointer.

I have often considered the ruby filter to be potentially the most powerful of all filters. I'd like to explore its use further. Is there a place I can read about all the event properties and methods available in the scope of that filter?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 11, 2016, 10:27am UTC](https://discuss.elastic.co/t/add-field-with-json-codec/41411/6 "2016-02-11T10:27:20Z")

</div>

I don't think there's any reference documentation. When necessary I look at the source code (which nowadays is Java, I believe) of the class backing the `event` variable. That covers most things.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:12am UTC](https://discuss.elastic.co/t/add-field-with-json-codec/41411/7 "2017-07-06T05:12:04Z")

</div>