# Distinguish json pattern and send it to specific index

**URL:** <https://discuss.elastic.co/t/distinguish-json-pattern-and-send-it-to-specific-index/191542>\
**Category:** Logstash\
**Created:** [July 21, 2019, 9:10pm UTC](https://discuss.elastic.co/t/distinguish-json-pattern-and-send-it-to-specific-index/191542 "2019-07-21T21:10:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hjsjar](https://avatars.discourse-cdn.com/v4/letter/h/db5fbb/32.png) [@hjsjar](https://discuss.elastic.co/u/hjsjar)\
**Post date:** [July 21, 2019, 9:10pm UTC](https://discuss.elastic.co/t/distinguish-json-pattern-and-send-it-to-specific-index/191542/1 "2019-07-21T21:10:52Z")

</div>

hi everyone

I have a logstash container querying data from a mysql table called events. The mysql table contains a json field that can contain different data structures, i need to identify when an event contains certain structure and send the event to the corresponding index so that every index contains all the events that follow the same json structure.

Im using the jdbc input plugin to read data from mysql and the elasticsearch output plugin to index the events.

here is an example of the different json structures you can find in the json field of the events table (i know all the different structures that can happen)

```
{"id":"5320","time":"1547749347","data":"27"}

{"id":"5320","time":"1547917026","data":[{"type":"1","value":"33.30"}]}

{"time":"1563742800.0","data":[{"id":"14050","type":"1","unit":"1","value":"31.7","message":"0b01000011100110000110110011001101"}]}

```

I have tried some filters but i couldn't find any suitable solution for this

help me ☹

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 21, 2019, 10:40pm UTC](https://discuss.elastic.co/t/distinguish-json-pattern-and-send-it-to-specific-index/191542/2 "2019-07-21T22:40:25Z")

</div>

Perhaps something like

```
    if [data][0][message] {
        mutate { add_field => { "targetIndex" => "foo" } }
    } else if [data][0][value] {
        mutate { add_field => { "targetIndex" => "bar" } }
    } else {
        mutate { add_field => { "targetIndex" => "baz" } }
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2019, 10:40pm UTC](https://discuss.elastic.co/t/distinguish-json-pattern-and-send-it-to-specific-index/191542/3 "2019-08-18T22:40:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.