# Easy way to parse flattened data type?
**URL:** https://discuss.elastic.co/t/easy-way-to-parse-flattened-data-type/343926
**Category:** Elasticsearch
**Created:** [September 26, 2023, 7:59pm UTC](https://discuss.elastic.co/t/easy-way-to-parse-flattened-data-type/343926 "2023-09-26T19:59:21Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@elasticnub](https://discuss.elastic.co/u/elasticnub)
#### Post date: [September 26, 2023, 7:59pm UTC](https://discuss.elastic.co/t/easy-way-to-parse-flattened-data-type/343926/1 "2023-09-26T19:59:21Z")
While I understand the reasoning behind the flattened data type, is there an easy way to split key value pairs out as their own field to use with dashboards / aggregations etc.
IE - m365\_defender.event.activity.objects is below
I would like to have access to m365\_defender.event.activity.objects.Role / type / value ETC...while I know you can query flattened values, I would like to make dashboards surrounding the values.
[
{
"Role": "Parameter",
"Type": "Structured object",
"Value": "99999",
"ServiceObjectType": "Session ID"
},
{
"Role": "Target object",
"Type": "Task",
"Name": "MailItemsAccessed"
},
{
"Role": "Parameter",
"Type": "Property",
"Value": "Bind",
"Name": "MailAccessType"
},
{
"Role": "Parameter",
"Type": "Property",
"Value": "False",
"Name": "IsThrottled"
},
{
"Role": "Actor",
"Type": "User",
"ApplicationInstance": 0,
"Id": "99999",
"ApplicationId": 99999,
"Name": "Random User 01"
}
]
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 24, 2023, 8:00pm UTC](https://discuss.elastic.co/t/easy-way-to-parse-flattened-data-type/343926/2 "2023-10-24T20:00:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.