# Grok array of jsons

**URL:** <https://discuss.elastic.co/t/grok-array-of-jsons/87484>\
**Category:** Logstash\
**Created:** [May 29, 2017, 6:36pm UTC](https://discuss.elastic.co/t/grok-array-of-jsons/87484 "2017-05-29T18:36:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kiranmai\_Reddy](https://avatars.discourse-cdn.com/v4/letter/k/50afbb/32.png) [@Kiranmai\_Reddy](https://discuss.elastic.co/u/Kiranmai_Reddy)\
**Post date:** [May 29, 2017, 6:36pm UTC](https://discuss.elastic.co/t/grok-array-of-jsons/87484/1 "2017-05-29T18:36:43Z")

</div>

how do I grok array of jsons  
eg:  
[2017-05-29 02:17:18] INFO – [ActivityServiceRest:89] – [{“callId”:”kjwefkjweqkfb”},{“callId”:”nwekgwnkqgkqr”},{“callId”:”ohjiwnwbnwbrk”}]

I want to store all the callId's in a field called call\_Id  
where number of times callId appears is dynamic  
Can someone please help.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 29, 2017, 7:44pm UTC](https://discuss.elastic.co/t/grok-array-of-jsons/87484/2 "2017-05-29T19:44:05Z")

</div>

Use a grok filter to extract the various pieces of the string into discrete fields. What's most important for your current question is that the JSON array is in a field of its own. Then have a json filter process that field, and finally you'll have to write a small piece of Ruby in a ruby filter to collect all the call id values into an array. This probably works:

```nohighlight
ruby {
  code => "event.set('call_Id', event.get('XXX').collect { |h| h['callId'] })"
}

```

Replace XXX with the name of the field containing the parsed JSON array.

---

<div class="post-metadata">

**Author:** ![Kiranmai\_Reddy](https://avatars.discourse-cdn.com/v4/letter/k/50afbb/32.png) [@Kiranmai\_Reddy](https://discuss.elastic.co/u/Kiranmai_Reddy)\
**Post date:** [May 30, 2017, 6:21am UTC](https://discuss.elastic.co/t/grok-array-of-jsons/87484/3 "2017-05-30T06:21:29Z")

</div>

Thanks a lot, it worked and I am able to get callId's in an array but it's giving me \_dataparsefailure in the tags. Is it something related to Json field in the input log?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 30, 2017, 7:46am UTC](https://discuss.elastic.co/t/grok-array-of-jsons/87484/4 "2017-05-30T07:46:59Z")

</div>

The Logstash log will contain details about the date filter's failure. You also need to post your Logstash configuration.

---

<div class="post-metadata">

**Author:** ![Kiranmai\_Reddy](https://avatars.discourse-cdn.com/v4/letter/k/50afbb/32.png) [@Kiranmai\_Reddy](https://discuss.elastic.co/u/Kiranmai_Reddy)\
**Post date:** [June 7, 2017, 9:57am UTC](https://discuss.elastic.co/t/grok-array-of-jsons/87484/5 "2017-06-07T09:57:16Z")

</div>

Yeah, there was an error in my logstash filter and I resolved it. Thanks for helping out

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:57am UTC](https://discuss.elastic.co/t/grok-array-of-jsons/87484/6 "2017-07-05T09:57:23Z")

</div>

Closed on July 5, 2017, 9:57am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.