# Extract a subfield value to display on Kibana
**URL:** https://discuss.elastic.co/t/extract-a-subfield-value-to-display-on-kibana/125800
**Category:** Logstash
**Created:** [March 27, 2018, 6:49pm UTC](https://discuss.elastic.co/t/extract-a-subfield-value-to-display-on-kibana/125800 "2018-03-27T18:49:04Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@arun3](https://discuss.elastic.co/u/arun3)
#### Post date: [March 27, 2018, 6:49pm UTC](https://discuss.elastic.co/t/extract-a-subfield-value-to-display-on-kibana/125800/1 "2018-03-27T18:49:04Z")
Hi,
Below is the content of a field say "Field1" when we do Discover with an index on Kibana dashboard. I want to extract value of a particular subfield like Request Size or Request IP or any other and visualize on Kibana.
How could we implement this? Are there any filter plugins or other ways to approach this.
## Field1
{
"API Details": {
"API Name": "api1"
"API Version": "v1"
"Request Size": "1101"
" Request IP": "10.17.192.201"
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 27, 2018, 7:58pm UTC](https://discuss.elastic.co/t/extract-a-subfield-value-to-display-on-kibana/125800/2 "2018-03-27T19:58:27Z")
The "Field1.API Details.Request Size" and "Field1.API Details.Request IP" fields will be available as-is, but if you want a shorter field name you can use a mutate filter to either rename the existing fields or copy them. Just mind the notation used for nested fields: [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references)
---
### Author:  [@arun3](https://discuss.elastic.co/u/arun3)
#### Post date: [March 28, 2018, 2:38am UTC](https://discuss.elastic.co/t/extract-a-subfield-value-to-display-on-kibana/125800/3 "2018-03-28T02:38:54Z")
Thanks for the response.
How could we access "Field1.API Details.Request Size" or "Field1.API Details.Request IP" to display on Kibana. When I do Sub Aggregation by Terms, I am able to see "Field1" only in the drop down.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 28, 2018, 6:14am UTC](https://discuss.elastic.co/t/extract-a-subfield-value-to-display-on-kibana/125800/4 "2018-03-28T06:14:18Z")
Have you refreshed the field list in Kibana?
If yes, please show an example document (copy/paste from Kibana's JSON tab) and a screenshot of what you just described.
---
### Author:  [@arun3](https://discuss.elastic.co/u/arun3)
#### Post date: [March 28, 2018, 7:13am UTC](https://discuss.elastic.co/t/extract-a-subfield-value-to-display-on-kibana/125800/5 "2018-03-28T07:13:21Z")
Yes Magnus , I refreshed the field list in Kibana, but not able to find.
I put below the excerpts of json file.
{
"\_index": "filebeat-2018.03.13"
"\_type": "log"
"\_version": "1"
"Field1": "{\n "API Details" : "{\n "API Name": "api1",\n "API Version": "v1",\n "Request Size": "1101",\n "Request IP": "10.17.192.201",\n }\n }
}
For some security reasons , I am not able to put the screenshot while I would like to explain you the scenario in bit detail for your understanding.
**_Scenario:_**
In Visualization section of Kibana, I select a "Table", then "Add Subucket" -\> "Split Rows" -\> "Sub Aggregation" by Terms -\> "Select a Field" . But in the dropdown field section , only I can see Field1.keyword .
I am still not able to find "Field1.API Details.Request Size" or "Field1.API Details.Request IP".
Could you please provide your insights.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 28, 2018, 7:30am UTC](https://discuss.elastic.co/t/extract-a-subfield-value-to-display-on-kibana/125800/6 "2018-03-28T07:30:04Z")
Okay, that explains things. The `Field1` field is a JSON string that you need to parse with a json filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 25, 2018, 7:30am UTC](https://discuss.elastic.co/t/extract-a-subfield-value-to-display-on-kibana/125800/7 "2018-04-25T07:30:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.