# Contructing JSON array output from logstash

**URL:** <https://discuss.elastic.co/t/contructing-json-array-output-from-logstash/135418>\
**Category:** Logstash\
**Created:** [June 11, 2018, 6:31pm UTC](https://discuss.elastic.co/t/contructing-json-array-output-from-logstash/135418 "2018-06-11T18:31:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hanciv](https://avatars.discourse-cdn.com/v4/letter/h/ea666f/32.png) [@Hanciv](https://discuss.elastic.co/u/Hanciv)\
**Post date:** [June 11, 2018, 6:31pm UTC](https://discuss.elastic.co/t/contructing-json-array-output-from-logstash/135418/1 "2018-06-11T18:31:03Z")

</div>

Hi,  
I am reading a log file where I have key value paired events. I extract the key value fields using KV filter and then construct a JSON manually like the below.

"[application][environment]" =\> "%{environment}"  
"[application][applicationName]" =\> "%{applicationName}"  
"[application][applicationModuleName]" =\> "%{applicationModuleName}"  
"[application][auditStepName]" =\> "%{auditStepName}"  
"[application][applicationModuleVersion]" =\> "%{applicationModuleVersion}"  
.  
.  
.  
"[DetailSection][elementDetail][rejectCode]" =\> "%{rejectCode}"  
"[DetailSection][elementDetail][rejectReasonDescription]" =\> "%{rejectReasonDescription}"  
"[DetailSection][elementDetail][severity]" =\> "%{severity}"

I have a requirement where in the elementDetail in the schema can only be an array and hence the JSON generated out of this is throwing schema error.  
I tried using [DetailSection][elementDetail][0][rejectCode], "[DetailSection][elementDetail][0][rejectReasonDescription]", but they dont work the intended way.

Any help is greatly appreciated!!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 11, 2018, 6:55pm UTC](https://discuss.elastic.co/t/contructing-json-array-output-from-logstash/135418/2 "2018-06-11T18:55:29Z")

</div>

If you have a field called rejectCode, then you can create an array inside an object using

```
mutate { add_field => { "[DetailSection][elementDetail][0][rejectCode]" => "%{rejectCode}" } }

```

That will produce

```auto
              "DetailSection" => {
        "elementDetail" => {
            "0" => {
                "rejectCode" => "a"
            }
        }
    },

```

What issue do you have with that?

---

<div class="post-metadata">

**Author:** ![Hanciv](https://avatars.discourse-cdn.com/v4/letter/h/ea666f/32.png) [@Hanciv](https://discuss.elastic.co/u/Hanciv)\
**Post date:** [June 11, 2018, 7:14pm UTC](https://discuss.elastic.co/t/contructing-json-array-output-from-logstash/135418/3 "2018-06-11T19:14:29Z")

</div>

I am getting the below JSON response rather than the expected respone as array:

"DetailsSection"{  
"elementDetail": {  
"0": {  
"reject code":"a"  
}  
}  
}

Exepected Response:

"DetailsSection"{  
"elementDetail": [  
{  
"reject code":"a"  
}  
]  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 11, 2018, 7:46pm UTC](https://discuss.elastic.co/t/contructing-json-array-output-from-logstash/135418/4 "2018-06-11T19:46:51Z")

</div>

Depending on whether you want the array to contain a single object or multiple objects...

```auto
    ruby {
        code => "
        a = []
        h = Hash.new
        event.to_hash.each { | k, v |
            if k == 'rejectCode' || k == 'rejectReasonDescription'
                # For an array where each entry contains a single object has use this instead
                #a << { k => v }
                h[k] = v
            end
        }
        a << h
        event.set( '[DetailSection][elementDetail]', a)
        "
    }

```

---

<div class="post-metadata">

**Author:** ![Hanciv](https://avatars.discourse-cdn.com/v4/letter/h/ea666f/32.png) [@Hanciv](https://discuss.elastic.co/u/Hanciv)\
**Post date:** [June 11, 2018, 7:55pm UTC](https://discuss.elastic.co/t/contructing-json-array-output-from-logstash/135418/5 "2018-06-11T19:55:31Z")

</div>

That worked like a charm. Thank you so much 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2018, 8:08pm UTC](https://discuss.elastic.co/t/contructing-json-array-output-from-logstash/135418/6 "2018-07-09T20:08:31Z")

</div>

Closed on July 9, 2018, 8:08pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.