# Extracting JSON and Parsing it
**URL:** https://discuss.elastic.co/t/extracting-json-and-parsing-it/85536
**Category:** Logstash
**Created:** [May 12, 2017, 9:57am UTC](https://discuss.elastic.co/t/extracting-json-and-parsing-it/85536 "2017-05-12T09:57:50Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Vedran\_Maricevic](https://discuss.elastic.co/u/Vedran_Maricevic)
#### Post date: [May 12, 2017, 9:57am UTC](https://discuss.elastic.co/t/extracting-json-and-parsing-it/85536/1 "2017-05-12T09:57:50Z")
I have a JSON log that comes to Logstash.
It looks like this:
> ```
> [{"orderNumber":"xxxxxxxx","externalOrderNumber":"07efc4c7d3113453427f7fe525e22a61e","operation":{"name":"CAPTURE","amount":990,"status":"PENDING","createdAt":"2011-05-11T04:58:21.187Z","updatedAt":{}}}]
> [{"paymentMethod":"Card","transactionId":"331d83fd-2456-48320-842a-f4122aa311e1","orderStatus":"SUCCESS","statuses":[{"amount":990,"operation":"CAPTURE","status":"SUCCESS","createdAt":"2012-05-11T04:58:26.252Z"},{"amount":990,"operation":"CAPTURE","status":"PENDING","createdAt":"2012-05-11T04:58:26.224Z"},{"amount":990,"operation":"AUTHORISE","status":"SUCCESS","createdAt":"2012-05-11T04:58:26.198Z"},{"amount":990,"operation":"AUTHORISE","status":"PENDING","createdAt":"2012-05-11T04:58:16.304Z"}]}]
>
> ```
Which is basically [{SOMEJSON}][{MOREJSON}]
I was thinking to do a patter where I grab the first "[" then I do %{GREEDYDATA:firstjson} until the]. The simply repeat the procedure.
I was not successfull in making this happen
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 12, 2017, 10:00am UTC](https://discuss.elastic.co/t/extracting-json-and-parsing-it/85536/2 "2017-05-12T10:00:43Z")
That approach should work. What did you try, exactly?
---
### Author:  [@Vedran\_Maricevic](https://discuss.elastic.co/u/Vedran_Maricevic)
#### Post date: [May 12, 2017, 10:14am UTC](https://discuss.elastic.co/t/extracting-json-and-parsing-it/85536/3 "2017-05-12T10:14:23Z")
To be honest I am stuck at the start. How do I start with the character '['. and end it with ']'
---
### Author:  [@Vedran\_Maricevic](https://discuss.elastic.co/u/Vedran_Maricevic)
#### Post date: [May 12, 2017, 10:27am UTC](https://discuss.elastic.co/t/extracting-json-and-parsing-it/85536/4 "2017-05-12T10:27:23Z")
This line:
> grok {
> match =\> { "message" =\> "[%{GREEDYDATA:firstjson}]"}
> }
> Takes it all. It does not stop at the ]
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 12, 2017, 1:13pm UTC](https://discuss.elastic.co/t/extracting-json-and-parsing-it/85536/5 "2017-05-12T13:13:08Z")
```
match => { "message" => "^\[%{GREEDYDATA:firstjson}\]$"}
```
I'd expect it to be faster to use a mutate filter and its gsub option to remove leading and trailing square brackets.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 9, 2017, 1:21pm UTC](https://discuss.elastic.co/t/extracting-json-and-parsing-it/85536/6 "2017-06-09T13:21:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.