# Extract fields from a json substring

**URL:** https://discuss.elastic.co/t/extract-fields-from-a-json-substring/199072
**Category:** Logstash
**Created:** [September 11, 2019, 11:38am UTC](https://discuss.elastic.co/t/extract-fields-from-a-json-substring/199072 "2019-09-11T11:38:07Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![harshavmb](https://avatars.discourse-cdn.com/v4/letter/h/e274bd/32.png) [@harshavmb](https://discuss.elastic.co/u/harshavmb)
#### Post date: [September 11, 2019, 11:38am UTC](https://discuss.elastic.co/t/extract-fields-from-a-json-substring/199072/1 "2019-09-11T11:38:07Z")

</div>

I'm fairly new to `Logstash` filtering stuff. I've below json string

```
{
    "changed": false, 
    "msg": "Foo Facts: oma_phase: prd, oma_app: fsd, oma_apptype: obe, oma_componenttype: oltp, oma_componentname: -, oma_peak: pk99, oma_phaselevel: prd"
}

```

I would like to extract the fields `oma_phase`, `oma_app`, `oma_apptype`, `oma_componenttype`, `oma_componentname`, `oma_peak` & `oma_phaselevel` .

I've tried below native json filter,

```
filter {
  if [type] == "ansible" {
    json {
      source => "ansible_result"
    }
  }
}

```

Here `ansible_result` is the key holding the above json value. However, there are many keys having different values but with the same `ansible_result` key. This is creating lot of index keys and I don't want that.

I would like to have some sort of filter which can match the substring `Foo Facts` and there after extracting the `oma_*` fields.

I somehow couldn't managed to do with `grok` filter to match the substring. It would be really great if you could help me with this.

Many thanks in advance..

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 9, 2019, 11:38am UTC](https://discuss.elastic.co/t/extract-fields-from-a-json-substring/199072/2 "2019-10-09T11:38:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.