# Filter JSON Array Using Logstash

**URL:** <https://discuss.elastic.co/t/filter-json-array-using-logstash/298253>\
**Category:** Logstash\
**Created:** [February 25, 2022, 8:37am UTC](https://discuss.elastic.co/t/filter-json-array-using-logstash/298253 "2022-02-25T08:37:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![AJEE123](https://avatars.discourse-cdn.com/v4/letter/a/ad7895/32.png) [@AJEE123](https://discuss.elastic.co/u/AJEE123)\
**Post date:** [February 25, 2022, 8:37am UTC](https://discuss.elastic.co/t/filter-json-array-using-logstash/298253/1 "2022-02-25T08:37:57Z")

</div>

Hi guys, can anybody help me?  
I have JSON Array as an input like this:

```auto
"reported_devices": [
                {
                    "id": "636e6930-6361-3a65-393a-36393a31643a", 
                    "ips": [
                        {
                            "address": "10.244.0.1", 
                            "version": "v4"
                        }, 
                        {
                            "address": "fe80::c8e9:69ff:fe1d:5d39", 
                            "version": "v6"
                        }
                    ], 
                    "mac": {
                        "address": "ca:e9:69:1d:5d:39"
                    }, 
                    "name": "cni0"
                }, 
                {
                    "id": "656e7333-3536-3a36-663a-66383a63363a", 
                    "ips": [
                        {
                            "address": "10.43.2.192", 
                            "version": "v4"
                        }, 
                        {
                            "address": "fe80::546f:f8ff:fec6:fd", 
                            "version": "v6"
                        }
                    ], 
                    "mac": {
                        "address": "56:6f:f8:c6:00:fd"
                    }, 
                    "name": "ens3"
                }, 
                {
                    "id": "666c616e-6e65-6c2e-3139-653a38653a65", 
                    "ips": [
                        {
                            "address": "10.244.0.0", 
                            "version": "v4"
                        }, 
                        {
                            "address": "fe80::9c8e:eaff:fe49:6000", 
                            "version": "v6"
                        }
                    ], 
                    "mac": {
                        "address": "9e:8e:ea:49:60:00"
                    }, 
                    "name": "flannel.1"
                }, 
                {
                    "id": "63616c69-3836-6430-3838-616337343365", 
                    "ips": [
                        {
                            "address": "fe80::ecee:eeff:feee:eeee", 
                            "version": "v6"
                        }
                    ], 
                    "mac": {
                        "address": "ee:ee:ee:ee:ee:ee"
                    }, 
                    "name": "cali86d088ac743"
                }, 
                {
                    "id": "63616c69-6231-3431-6432-653938656665", 
                    "ips": [
                        {
                            "address": "fe80::ecee:eeff:feee:eeee", 
                            "version": "v6"
                        }
                    ], 
                    "mac": {
                        "address": "ee:ee:ee:ee:ee:ee"
                    }, 
                    "name": "calib141d2e98ef"
                }
            ]

```

I want to filter the data and get only the data for "address": "10.43.2.192" and discard the others, how to do it?

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [February 25, 2022, 2:59pm UTC](https://discuss.elastic.co/t/filter-json-array-using-logstash/298253/2 "2022-02-25T14:59:16Z")

</div>

Hey,

i'm going to make this as simple as possible, you know you can parse data with the JSON filter and then access it with something like %{[reported\_devices][1][ips][0][address]}

What you have to use is a ruby code to iter through the json arrays and extract values like %{[reported\_devices][xx][ips][0][address]} .

What is suggest to anyone working in JSON is to try to manipulate their files trough a JSON navigator ( like dropping it into firefox ) and actually see what's the structure of the data i'm using.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 25, 2022, 3:00pm UTC](https://discuss.elastic.co/t/filter-json-array-using-logstash/298253/3 "2022-03-25T15:00:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.