# Format object with key value

**URL:** https://discuss.elastic.co/t/format-object-with-key-value/134735
**Category:** Logstash
**Created:** [June 6, 2018, 6:52am UTC](https://discuss.elastic.co/t/format-object-with-key-value/134735 "2018-06-06T06:52:04Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![arnaud\_beun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arnaud_beun/32/43328_2.png) [@arnaud\_beun](https://discuss.elastic.co/u/arnaud_beun)
#### Post date: [June 6, 2018, 6:52am UTC](https://discuss.elastic.co/t/format-object-with-key-value/134735/1 "2018-06-06T06:52:05Z")

</div>

Hi,

I am exporting AWS WAF samples to or elasticsearch and JSON WAF return look like this :

{  
"@timestamp":"2018-06-01T05:05:48.792Z",  
"Headers":[  
{  
"Value":"xxx",  
"Name":"Host"  
},  
{  
"Value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36",  
"Name":"User-Agent"  
}  
],  
"@version":"1",  
"Country":"TW",  
"Method":"HEAD",  
"HTTPVersion":"HTTP/1.1",  
"type":"xxx",  
"ClientIP":"xxx",  
"URI":"/"  
}

I am using json codec to parse it and everything is fine except the Headers part.

"Headers":[  
{  
"Name":"Host",  
"Value":"54.246.206.67"  
},  
{  
"Name":"User-Agent",  
"Value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"  
}  
],

The Headers key has an object into it and this object can contain multilpe values.

I would like to get all Headers objects and format them like this :

"Headers"."Host":"54.246.206.67",  
"Headers"."User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36",

Is someone here can help me with this ?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 6, 2018, 2:13pm UTC](https://discuss.elastic.co/t/format-object-with-key-value/134735/2 "2018-06-06T14:13:52Z")

</div>

There is an example of something similar [here](https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481/12?u=badger).

---

<div class="post-metadata">

### Author: ![arnaud\_beun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arnaud_beun/32/43328_2.png) [@arnaud\_beun](https://discuss.elastic.co/u/arnaud_beun)
#### Post date: [June 6, 2018, 2:49pm UTC](https://discuss.elastic.co/t/format-object-with-key-value/134735/3 "2018-06-06T14:49:44Z")

</div>

Hello Badger,

Thank you so much for your help, it is working well for me.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 4, 2018, 2:49pm UTC](https://discuss.elastic.co/t/format-object-with-key-value/134735/4 "2018-07-04T14:49:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
