# Extracting nested fileds with grok or kv
**URL:** https://discuss.elastic.co/t/extracting-nested-fileds-with-grok-or-kv/349766
**Category:** Logstash
**Created:** [December 21, 2023, 7:29am UTC](https://discuss.elastic.co/t/extracting-nested-fileds-with-grok-or-kv/349766 "2023-12-21T07:29:38Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@cass1ope1a](https://discuss.elastic.co/u/cass1ope1a)
#### Post date: [December 21, 2023, 7:29am UTC](https://discuss.elastic.co/t/extracting-nested-fileds-with-grok-or-kv/349766/1 "2023-12-21T07:29:38Z")
I have logs like:
`Server response. Body={"valid":[{"someId":"12345","someType":"somevalue123","isSome":true}],"invalid":[]}`
current pipeline config:
```auto
if [syslog_tag] =~ "json" {
json {
source => root_message
}
mutate {
remove_field => ["root_message"]
}
}
```
I need to extract fields (someType, someId, etc..) to Kibana for using filter
Instead of: `message: "somevalue123" AND message: "12345"`
I wanna use `someType: "somevalue123" AND someId: "12345"`
I've tried to change pipeline config like this:
```auto
if [syslog_tag] =~ "json" {
json {
source => root_message
}
mutate {
remove_field => ["root_message"]
}
grok {
match => { message => "%{GREEDYDATA:message} Body=%{GREEDYDATA:json_message} "}
}
json {
source => json_message
}
mutate {
remove_filed => ["json_message"]
}
}
```
But it doesn't work
What should I fix in config to make it? Maybe I should use kv?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 18, 2024, 7:30am UTC](https://discuss.elastic.co/t/extracting-nested-fileds-with-grok-or-kv/349766/2 "2024-01-18T07:30:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.