# Decompose json array string in Logstash

**URL:** <https://discuss.elastic.co/t/decompose-json-array-string-in-logstash/95763>\
**Category:** Logstash\
**Created:** [August 3, 2017, 6:44pm UTC](https://discuss.elastic.co/t/decompose-json-array-string-in-logstash/95763 "2017-08-03T18:44:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bitesize](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@bitesize](https://discuss.elastic.co/u/bitesize)\
**Post date:** [August 3, 2017, 6:44pm UTC](https://discuss.elastic.co/t/decompose-json-array-string-in-logstash/95763/1 "2017-08-03T18:44:15Z")

</div>

I have a RabbitMQ sending 3 fields in JSON format and it is being consumed by Logstash rabbitmq input plugin.

One of the fields is a JSON array of strings as follows:

```
"content": [
  "1111",
  "2222222",
  "Test 06",
  "3",
  "3232",
  "SomeValue1"
]

```

How could I make each entry of that string into a field so that I can quickly discover and visualize in Kibana from the available fields? Right now I see "content" with that full string.  
The JSON array string size changes depending on another field, eventID. Would it be possible to dynamically map the values in that string to specific names depending on the eventID?  
Such as:

```
"eventID": 1,
  "content": [
  "name1": "1111",
  "name2": "2222222",
  "name3": "Test 06",
  "name4": "3",
  "name5": "3232",
  "name6": "SomeValue1"
]

"eventID": 2,
  "content": [
  "othername1": "3434",
  "othername2": "Test 10",
  "othername3": "876",
  "othername4": "Some String7"
]

```

I would like to have the name\* and othername\* in the available fields. Any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 3, 2017, 6:58pm UTC](https://discuss.elastic.co/t/decompose-json-array-string-in-logstash/95763/2 "2017-08-03T18:58:58Z")

</div>

Look into the ruby filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2017, 6:59pm UTC](https://discuss.elastic.co/t/decompose-json-array-string-in-logstash/95763/3 "2017-08-31T18:59:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.