# Grok to parse Json in a Json

**URL:** <https://discuss.elastic.co/t/grok-to-parse-json-in-a-json/222258>\
**Category:** Logstash\
**Created:** [March 5, 2020, 10:01am UTC](https://discuss.elastic.co/t/grok-to-parse-json-in-a-json/222258 "2020-03-05T10:01:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aashish](https://avatars.discourse-cdn.com/v4/letter/a/65b543/32.png) [@aashish](https://discuss.elastic.co/u/aashish)\
**Post date:** [March 5, 2020, 10:01am UTC](https://discuss.elastic.co/t/grok-to-parse-json-in-a-json/222258/1 "2020-03-05T10:01:42Z")

</div>

Hi Team,

I'm facing issue to parse json in a json. Below is my sample log. Using Json formate in logstash it is working fine. But now I want to parse fields that are in "txn\_pl\_resp" (i.e. code & message)  
Using ELK version 5.4.

> {  
> "app\_name": "myapp",  
> "txn\_id": "6816250463",  
> "txn\_ts": "2020-02-28 13:19:35.556269",  
> "txn\_end\_ts": "2020-02-28 13:19:35.606198",  
> "email\_id": "abc@yahoo.co.in",  
> "txn\_type": "LOGIN\_TMSTMP",  
> "txn\_catgry": "Cache\_DB",  
> "txn\_method": "POST",  
> "txn\_host": "xyz.itm",  
> "txn\_dur": "50.061",  
> "txn\_status": "SUCCESS",  
> "txn\_pl\_req": "'POST|xyz@yahoo.co.in|{"reqst":"LOGIN\_TMSTMP"}'",  
> "txn\_pl\_resp": "'{"status":{"code":"200","message":"SUCCESS : Login successful for user xyz@yahoo.co.in"},  
> "body":{"current\_timestamp":"20200228184935","previous\_timestamp":"20200125163533"}  
> }

Below is my current Logstash config file setting, Please suggest what changes need to be done -

> filter {  
> if [type] == "myapp-log" {  
> json {  
> source =\> "message"  
> }  
> }  
> }
> 
> output {  
> if [type] == "myapp-log" {  
> elasticsearch {  
> hosts =\> ["0.0.0.0:9200","10.10.10.10:9200""]  
> index =\> "\<myapp-{now/d}\>"  
> workers =\> 4  
> }  
> }  
> }

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 5, 2020, 2:34pm UTC](https://discuss.elastic.co/t/grok-to-parse-json-in-a-json/222258/2 "2020-03-05T14:34:42Z")

</div>

> [@aashish](#):
>
> txn\_pl\_resp

Use a second json filter to parse txn\_pl\_resp.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2020, 2:36pm UTC](https://discuss.elastic.co/t/grok-to-parse-json-in-a-json/222258/3 "2020-04-02T14:36:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.