# Filebeat JSON Parsing

**URL:** https://discuss.elastic.co/t/filebeat-json-parsing/331023
**Category:** Beats
**Tags:** filebeat
**Created:** [April 28, 2023, 7:27am UTC](https://discuss.elastic.co/t/filebeat-json-parsing/331023 "2023-04-28T07:27:19Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Tussingh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tussingh/32/116802_2.png) [@Tussingh](https://discuss.elastic.co/u/Tussingh)
#### Post date: [April 28, 2023, 7:27am UTC](https://discuss.elastic.co/t/filebeat-json-parsing/331023/1 "2023-04-28T07:27:19Z")

</div>

I am trying to ingest below JSON to elastic through filebeat http json input plugin.

[  
{  
"metricId": 185016812,  
"metricName": "BTM|Application Diagnostic Data|Base Page:20869077|Synthetic Visually Complete Time (ms)",  
"metricPath": "End User Experience|Base [Pages|login.microsoftonline.com/1a407a2d-7675-4d17-8692-b3ac285306e4/login|Synthetic](http://Pages%7Clogin.microsoftonline.com/1a407a2d-7675-4d17-8692-b3ac285306e4/login%7CSynthetic) Visually Complete Time (ms)",  
"frequency": "ONE\_MIN",  
"metricValues": [  
{  
"startTimeInMillis": 1682654100000,  
"occurrences": 0,  
"current": 119,  
"min": 0,  
"max": 432,  
"useRange": true,  
"count": 4,  
"sum": 1062,  
"value": 266,  
"standardDeviation": 0  
}  
]  
},

Not the problem is I want to seperate the metric path and metric name itself so that I can get the seggregated values inside elastic. Please tell me how can I do that

Configuration:

filebeat.inputs:

- type: httpjson  
enabled: true  
id: CP\_M2O\_Channel\_Management  
interval: 1m  
request.url:   
auth.basic.user: ""  
auth.basic.password: ""  
request.method: GET  
request.transforms:

---

<div class="post-metadata">

### Author: ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)
#### Post date: [May 3, 2023, 2:43pm UTC](https://discuss.elastic.co/t/filebeat-json-parsing/331023/2 "2023-05-03T14:43:55Z")

</div>

The [dissect processor](https://www.elastic.co/guide/en/beats/filebeat/current/dissect.html) could probably do the trick.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 31, 2023, 4:44pm UTC](https://discuss.elastic.co/t/filebeat-json-parsing/331023/3 "2023-05-31T16:44:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
