# Filter embedded JSON

**URL:** https://discuss.elastic.co/t/filter-embedded-json/51682
**Category:** Logstash
**Created:** [June 2, 2016, 12:32pm UTC](https://discuss.elastic.co/t/filter-embedded-json/51682 "2016-06-02T12:32:51Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Andrej\_van\_der\_Zee](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@Andrej\_van\_der\_Zee](https://discuss.elastic.co/u/Andrej_van_der_Zee)
#### Post date: [June 2, 2016, 12:32pm UTC](https://discuss.elastic.co/t/filter-embedded-json/51682/1 "2016-06-02T12:32:51Z")

</div>

Hi,

My logs have embedded escaped JSON in one of its input JSON fields:

{  
"log": "{"timestamp":"2016-06-02T07:49:05.850+00:00","message":"Stopping beans in phase 0","level":"INFO"}",  
"stream": "stdout",  
"time": "2016-06-02T07:49:05.858092736Z"  
}

Now I would like to configure a filter that creates the JSON attributes in the escaped "log" value in my output:

{  
"timestamp": "2016-06-02T07:49:05.850+00:00",  
"message": "Stopping beans in phase 0"  
"level" : "info"  
....  
}

How can I do this?

Thanks,  
Andrej

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 14, 2016, 6:06pm UTC](https://discuss.elastic.co/t/filter-embedded-json/51682/2 "2016-06-14T18:06:41Z")

</div>

Use a json filter with `source => "log"` or a json codec for the input plugin you use.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/filter-embedded-json/51682/3 "2017-07-06T04:53:01Z")

</div>