# Can't figure out the field to split on

**URL:** <https://discuss.elastic.co/t/cant-figure-out-the-field-to-split-on/182590>\
**Category:** Logstash\
**Created:** [May 24, 2019, 8:40am UTC](https://discuss.elastic.co/t/cant-figure-out-the-field-to-split-on/182590 "2019-05-24T08:40:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [May 24, 2019, 8:40am UTC](https://discuss.elastic.co/t/cant-figure-out-the-field-to-split-on/182590/1 "2019-05-24T08:40:41Z")

</div>

Hi,

I'm using curl to query Elasticsearch. The response is in JSON and looks like the example below. But I can't figure out which field to split on to create a seperate document for each person.

I tried json filter and splitting on various fields such as persons or key. I also tried json codec in the input and then a split filter but no matter what I do I don't get the desired result.

Where am I going wrong?

```
{
  "took": 12,
  "timed_out": false,
  "_shards": {
    "total": 43,
    "successful": 43,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 10000,
      "relation": "gte"
    },
    "max_score": null,
    "hits": [
      
    ]
  },
  "aggregations": {
    "persons": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "8913514",
          "doc_count": 6899,
          "latest_data": {
            "hits": {
              "total": {
                "value": 6899,
                "relation": "eq"
              },
              "max_score": null,
              "hits": [
                {
                  "_index": "index",
                  "_type": "doc",
                  "_id": "f0zg6GoBvaTlju420DQW",
                  "_score": null,
                  "_source": {
                    "@timestamp": "2019-05-24T07:59:00.290Z",
                    "type": "basic",
                    "name": "person C"
                  },
                  "sort": [
                    1558684740290
                  ]
                }
              ]
            }
          }
        },
        {
          "key": "9443827",
          "doc_count": 6810,
          "latest_data": {
            "hits": {
              "total": {
                "value": 6810,
                "relation": "eq"
              },
              "max_score": null,
              "hits": [
                {
                  "_index": "index",
                  "_type": "doc",
                  "_id": "L0vf6GoBvaTlju42Bf8f",
                  "_score": null,
                  "_source": {
                    "@timestamp": "2019-05-24T07:59:00.178Z",
                    "type": "basic",
                    "name": "person A"
                  },
                  "sort": [
                    1558684740178
                  ]
                }
              ]
            }
          }
        },
        {
          "key": "9174490",
          "doc_count": 23,
          "latest_data": {
            "hits": {
              "total": {
                "value": 23,
                "relation": "eq"
              },
              "max_score": null,
              "hits": [
                {
                  "_index": "index",
                  "_type": "doc",
                  "_id": "vUve6GoBvaTlju42JNko",
                  "_score": null,
                  "_source": {
                    "@timestamp": "2019-05-24T07:59:00.232Z",
                    "type": "basic",
                    "name": "person B"
                  },
                  "sort": [
                    1558684740232
                  ]
                }
              ]
            }
          }
        }
      ]
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2019, 8:40am UTC](https://discuss.elastic.co/t/cant-figure-out-the-field-to-split-on/182590/2 "2019-06-21T08:40:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.