Convert a json nested string array to a flat string

[hmed]

Hello,

I have this JSON

{
"users":"[{"id":1,"name":"bob"},{"id":2,"name":"alice"},{"id":3,"name":"david"}]",
"date":"23/01/2017"
}

even if I'm using the logstash filter:

filter {
split {
field => "users"
}
}

the message is stored in elastic as single event

users => [{"id":1,"name":"bob"},{"id":2,"name":"alice"},{"id":3,"name":"david"}]
date=> 23/01/2017

question1: how I can convert the user field from string to a json array to have this

"users":[{"id":1,"name":"bob"},{"id":2,"name":"alice"},{"id":1,"name":"david"}],
"date":"23/01/2017"
}

question 2: how I can store this nested json as a multiple json events in elastic

Expected output:

{
"id":1,
"name":"bob",
"date":"23/01/2017"
}

{
"id":2,
"name":"alice",
"date":"23/01/2017"
}

{
"id":3,
"name":"david",
"date":"23/01/2017"
}

Thanks in advance for your answer

[magnusbaeck (Magnus Bäck)]

question1: how I can convert the user field from string to a json array to have this

Use the json filter.

question 2: how I can store this nested json as a multiple json events in elastic

Use the split filter.

[hmed]

Hello @magnusbaeck,

Many thanks for your answer.

Actually I'm using both json filter and split filters lik this
json {
source => "users"
}
split {
field => "users"
}

but I still have my users filed stored in elastic as string

users => [{"id":1,"name":"bob"},{"id":2,"name":"alice"},{"id":3,"name":"david"}]

Do you have any idea on what is wrong with my logstash conf ?

this is the warn log I have in logstash:

Parsed JSON object/hash requires a target configuration option {:source=>"users", :raw=>" [{"id":1,"name":"bob"},{"id":2,"name":"alice"},{"id":3,"name":"david"}]"}

Thanks in advance.

[magnusbaeck (Magnus Bäck)]

Parsed JSON object/hash requires a target configuration option

You need to use the target option in the json filter to choose a field to store the array in.