# Extract json array using logstash to elasticsearch

**URL:** <https://discuss.elastic.co/t/extract-json-array-using-logstash-to-elasticsearch/217276>\
**Category:** Logstash\
**Created:** [January 30, 2020, 9:28pm UTC](https://discuss.elastic.co/t/extract-json-array-using-logstash-to-elasticsearch/217276 "2020-01-30T21:28:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![emailshak](https://avatars.discourse-cdn.com/v4/letter/e/ad7895/32.png) [@emailshak](https://discuss.elastic.co/u/emailshak)\
**Post date:** [January 30, 2020, 9:28pm UTC](https://discuss.elastic.co/t/extract-json-array-using-logstash-to-elasticsearch/217276/1 "2020-01-30T21:28:33Z")

</div>

I am trying to extract the following json to elasticsearch using logstash

{  
"times\_submitted": 6,  
"name": "task1",  
"sub\_names": ["rescan", "that.doc", "c:\sorted\files\file1.exe"],  
"tree": { "child1" : "abc",  
"child2": {  
grandchild1: "def",  
grandchild2: "ghi"  
}  
}  
}

I have created a template for this json in elasticsearch. I am able to capture all of the fields from this json except for "sub\_names". The format of its contents in elasticsearch shows up as  
"sub\_names": """rescan,that.doc,c:\sorted\files\file1.exe"""

How do i carry over the sub\_name field as an array to elasticsearch ?  
How do i capture the tree fields into elasticsearch?

In my logstash filter i have the following

filter {  
json {  
source =\> "message"  
target =\> "message"  
}

json {  
source =\> "[message][tree]"  
target =\> "[message][tree]"  
}  
mutate {  
add\_field {  
"[task][times\_submitted]" =\> "%{[message][times\_submitted]}"  
"[task][name]" =\> "%{[message][name]}"  
"[task][sub\_names]" =\> "%{[message][sub\_names]}"  
"[task][tree]" =\> "%{[message][tree]}"  
}  
}  
}

Thanks for helping.

---

<div class="post-metadata">

**Author:** ![emailshak](https://avatars.discourse-cdn.com/v4/letter/e/ad7895/32.png) [@emailshak](https://discuss.elastic.co/u/emailshak)\
**Post date:** [February 3, 2020, 4:55pm UTC](https://discuss.elastic.co/t/extract-json-array-using-logstash-to-elasticsearch/217276/2 "2020-02-03T16:55:46Z")

</div>

By using mutate {rename =\> {"[message][sub\_names]" =\> "[task][sub\_names]"}}. I got sub\_names populated in elasticsearch as expected.

While trying the same technique for extracting the tree information I get an error stating type = illegal\_state\_exception, reason = Can't get text on a START\_OBJECT at 1:373

"tree": { "child1" : "abc",  
"child2": { grandchild1: "def",  
grandchild2: "ghi"  
}  
}

Need some pointers to extract the tree information. Appreciate your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2020, 4:55pm UTC](https://discuss.elastic.co/t/extract-json-array-using-logstash-to-elasticsearch/217276/3 "2020-03-02T16:55:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.