# Getting location out of a json field

**URL:** <https://discuss.elastic.co/t/getting-location-out-of-a-json-field/142893>\
**Category:** Logstash\
**Created:** [August 3, 2018, 11:03am UTC](https://discuss.elastic.co/t/getting-location-out-of-a-json-field/142893 "2018-08-03T11:03:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![JPelastic](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@JPelastic](https://discuss.elastic.co/u/JPelastic)\
**Post date:** [August 3, 2018, 11:03am UTC](https://discuss.elastic.co/t/getting-location-out-of-a-json-field/142893/1 "2018-08-03T11:03:00Z")

</div>

So i have filters

- source =\> certificate : which contains a JSON object.

Down in this certificate I have a SignatoryLocation. I'm trying to take that SignatoryLocation and add it as a field (so I can use it in a geoip-filter after that):

> json {  
> source =\> "certificate"  
> add\_field =\> { "location" : "%{SignatoryLocation}" }  
> }  
> geoip {  
> database =\> "C:\some\path\to\GeoLite2-City.mmdb"  
> source =\> "location"  
> }

This is kind of the path to the SignatoryLocation:

> certificate\field\another\anotherYet\Signatory\SignatoryLocation

What kind of pathing do I use to get to this SignatoryLocation?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 3, 2018, 11:09am UTC](https://discuss.elastic.co/t/getting-location-out-of-a-json-field/142893/2 "2018-08-03T11:09:24Z")

</div>

See [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references) for the notation used to access nested fields.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2018, 1:30pm UTC](https://discuss.elastic.co/t/getting-location-out-of-a-json-field/142893/4 "2018-08-31T13:30:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.