# Dealing with logstash conf file for json string array

**URL:** <https://discuss.elastic.co/t/dealing-with-logstash-conf-file-for-json-string-array/140156>\
**Category:** Logstash\
**Created:** [July 16, 2018, 1:50pm UTC](https://discuss.elastic.co/t/dealing-with-logstash-conf-file-for-json-string-array/140156 "2018-07-16T13:50:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![emailshak](https://avatars.discourse-cdn.com/v4/letter/e/ad7895/32.png) [@emailshak](https://discuss.elastic.co/u/emailshak)\
**Post date:** [July 16, 2018, 1:50pm UTC](https://discuss.elastic.co/t/dealing-with-logstash-conf-file-for-json-string-array/140156/1 "2018-07-16T13:50:13Z")

</div>

I am trying to move the following json in a text file to elasticsearch using logstash.

{"vehicles":{"brand":"honda", "type":["suv","sedan","convertible"]}} .

The logstash processs runs fine and inserts this record to elasticsearch. The problem i am having in elasticsearch is that the type value is converted to a string as displayed below  
"type": "suv,sedan,convertible"

How do i get type to be "type":["suv","sedan","convertible"]

I have the following in my logstash filter

filter  
{  
json {  
source =\> "message"  
target =\> "message"  
}  
mutate {  
add\_field =\> {  
"brand" =\> "%{[message][vehicles][brand]}"  
"type" =\> "%{[message][vehicles][type]}"  
}  
remove\_field =\> ["message"]  
}

}

Appreciate your help. Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 16, 2018, 2:23pm UTC](https://discuss.elastic.co/t/dealing-with-logstash-conf-file-for-json-string-array/140156/2 "2018-07-16T14:23:22Z")

</div>

> [@emailshak](#):
>
> add\_field =\> {  
> "brand" =\> "%{[brand]}"  
> "type" =\> "%{[type]}"  
> }

What are you trying to do with this? If type is an array, that will overwrite type with the array converted to a string, which is exactly what you are complaining about.

If you have target set to message in your json filter the type field will be [message][vehicles][type]. If you want that at the top level use

```
mutate {
    rename => { "[message][vehicles][type]" => "type" }
}

```

---

<div class="post-metadata">

**Author:** ![emailshak](https://avatars.discourse-cdn.com/v4/letter/e/ad7895/32.png) [@emailshak](https://discuss.elastic.co/u/emailshak)\
**Post date:** [July 16, 2018, 3:59pm UTC](https://discuss.elastic.co/t/dealing-with-logstash-conf-file-for-json-string-array/140156/3 "2018-07-16T15:59:08Z")

</div>

Hi Badger, Thanks for your response.

My current filter settings are

filter  
{  
json {  
source =\> "message"  
target =\> "message"  
}  
mutate {  
add\_field =\> {  
"brand" =\> "%{[message][vehicles][brand]}"  
"type" =\> "%{[message][vehicles][type]}"  
}  
remove\_field =\> ["message"]  
}

}

In elastic search i want the type data to be "type":["suv","sedan","convertible"] .  
At present i am seeing "type": "suv,sedan,convertible"

How do I achieve this ?  
Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 16, 2018, 4:03pm UTC](https://discuss.elastic.co/t/dealing-with-logstash-conf-file-for-json-string-array/140156/4 "2018-07-16T16:03:52Z")

</div>

Use mutate+rename, which I gave a sample of in my previous port.

---

<div class="post-metadata">

**Author:** ![emailshak](https://avatars.discourse-cdn.com/v4/letter/e/ad7895/32.png) [@emailshak](https://discuss.elastic.co/u/emailshak)\
**Post date:** [July 16, 2018, 4:13pm UTC](https://discuss.elastic.co/t/dealing-with-logstash-conf-file-for-json-string-array/140156/5 "2018-07-16T16:13:11Z")

</div>

I see how this is working now. I am all set. Appreciate your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2018, 4:13pm UTC](https://discuss.elastic.co/t/dealing-with-logstash-conf-file-for-json-string-array/140156/6 "2018-08-13T16:13:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.