# Flat text to json object

**URL:** <https://discuss.elastic.co/t/flat-text-to-json-object/219969>\
**Category:** Logstash\
**Created:** [February 19, 2020, 1:16pm UTC](https://discuss.elastic.co/t/flat-text-to-json-object/219969 "2020-02-19T13:16:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![AdamJade](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@AdamJade](https://discuss.elastic.co/u/AdamJade)\
**Post date:** [February 19, 2020, 1:16pm UTC](https://discuss.elastic.co/t/flat-text-to-json-object/219969/1 "2020-02-19T13:16:58Z")

</div>

Hi there  
I have a problem to transform this line form a log file line to a json object.  
The line is like this  
[2020-02-14 14:33:08.882] [VALUE1] [VALUE2] [VALUE3] [VALUE4] [VALUE5] [VALUE6] [VALUE7] [VALUE8] # Other text  
to  
Property1 : "VALUE1",  
Property2 : "VALUE2",  
Property3 : "VALUE3",  
Property4 : "VALUE4",  
Property5 : "VALUE5",  
Property6 : "VALUE6",  
Property7 : "VALUE7",  
Property8 : "VALUE8",  
Property9: "Other text"  
to store it easily in elasticsearch.

Thanks for any help

---

<div class="post-metadata">

**Author:** ![AdamJade](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@AdamJade](https://discuss.elastic.co/u/AdamJade)\
**Post date:** [February 19, 2020, 2:59pm UTC](https://discuss.elastic.co/t/flat-text-to-json-object/219969/2 "2020-02-19T14:59:15Z")

</div>

with this  
filter {  
grok {  
match =\> { "message" =\> "[%{TIMESTAMP\_ISO8601:Property1}] [%{WORD:Property2}] [%{WORD:Property3}] [%{WORD:Property4}] [%{WORD:Property5}] [%{WORD:Property6}] [%{WORD:Property7}] [%{DATA:Property8}] [%{DATA:Property9}] ?# %{DATA:Property10}" }  
}  
}  
but last key-value property10 : # other text.... does not give me 'other text...'  
Any help?

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [February 19, 2020, 3:29pm UTC](https://discuss.elastic.co/t/flat-text-to-json-object/219969/3 "2020-02-19T15:29:23Z")

</div>

Using _Grok Debugger_ in Kibana I got this (basically added _end of line_ which is $ to the end of the GROK pattern

> [%{TIMESTAMP\_ISO8601:Property1}]%{SPACE}[%{WORD:Property2}]%{SPACE}[%{WORD:Property3}]%{SPACE}[%{WORD:Property4}]%{SPACE}[%{WORD:Property5}]%{SPACE}[%{WORD:Property6}]%{SPACE}[%{WORD:Property7}]%{SPACE}[%{WORD:Property8}]%{SPACE}[%{WORD:Property9}]%{SPACE}#%{SPACE}%{DATA:Property10}$

Resulted in

```
{
  "Property4": "VALUE3",
  "Property3": "VALUE2",
  "Property2": "VALUE1",
  "Property1": "2020-02-14 14:33:08.882",
  "Property10": "Other text",
  "Property9": "VALUE8",
  "Property8": "VALUE7",
  "Property7": "VALUE6",
  "Property6": "VALUE5",
  "Property5": "VALUE4"
}

```

---

<div class="post-metadata">

**Author:** ![AdamJade](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@AdamJade](https://discuss.elastic.co/u/AdamJade)\
**Post date:** [February 19, 2020, 3:48pm UTC](https://discuss.elastic.co/t/flat-text-to-json-object/219969/4 "2020-02-19T15:48:57Z")

</div>

Thank s a lot, it works,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2020, 3:49pm UTC](https://discuss.elastic.co/t/flat-text-to-json-object/219969/5 "2020-03-18T15:49:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.