# Deserializing a json string and make it a name in an index to ES

**URL:** <https://discuss.elastic.co/t/deserializing-a-json-string-and-make-it-a-name-in-an-index-to-es/90328>\
**Category:** Logstash\
**Created:** [June 21, 2017, 4:09pm UTC](https://discuss.elastic.co/t/deserializing-a-json-string-and-make-it-a-name-in-an-index-to-es/90328 "2017-06-21T16:09:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![EigoCogito](https://avatars.discourse-cdn.com/v4/letter/e/d6d6ee/32.png) [@EigoCogito](https://discuss.elastic.co/u/EigoCogito)\
**Post date:** [June 21, 2017, 4:09pm UTC](https://discuss.elastic.co/t/deserializing-a-json-string-and-make-it-a-name-in-an-index-to-es/90328/1 "2017-06-21T16:09:25Z")

</div>

Hello People,

I'm relatively new to the ELK stack and have made progress in getting data into ES, however I would really appreciate some pointers on the following:

My setup is sending data to kafka and then to ES through an input/output configuration of logstash.

Please see below:

logstash.conf:

input {  
kafka {  
topics =\> ["x"]  
decorate\_events =\> true  
bootstrap\_servers =\> "localhost:9092"  
key\_deserializer\_class =\> "org.apache.kafka.common.serialization.StringDeserializer"  
value\_deserializer\_class =\> "org.apache.kafka.common.serialization.StringDeserializer"  
}  
}

filter {  
}

output {  
elasticsearch {  
hosts =\> "es:9200"  
index =\> "latest"  
manage\_template =\> false  
action =\> "update"  
}  
}

The data is fully visible in Kibana, however there is one field called message with is string of json which has several interesting entries in it. I would like these entries to also be names in the index so they can be used later for visualization (they have numerical values there). I was playing with the "key\_deserializer\_class" thinking that this might be able to deconstruct a string and auto create an aggregatable name in the index, however no joy.

Any general pointers would be greatly appreciated.

Thanks

---

<div class="post-metadata">

**Author:** ![EigoCogito](https://avatars.discourse-cdn.com/v4/letter/e/d6d6ee/32.png) [@EigoCogito](https://discuss.elastic.co/u/EigoCogito)\
**Post date:** [June 21, 2017, 6:31pm UTC](https://discuss.elastic.co/t/deserializing-a-json-string-and-make-it-a-name-in-an-index-to-es/90328/2 "2017-06-21T18:31:33Z")

</div>

I got it - Had to add codec =\> "json" to the input section for kafka in the logstash.conf - trust this helps others also 🙂 .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 19, 2017, 6:31pm UTC](https://discuss.elastic.co/t/deserializing-a-json-string-and-make-it-a-name-in-an-index-to-es/90328/3 "2017-07-19T18:31:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.