# Help with logstash config

**URL:** <https://discuss.elastic.co/t/help-with-logstash-config/148910>\
**Category:** Logstash\
**Created:** [September 18, 2018, 3:30am UTC](https://discuss.elastic.co/t/help-with-logstash-config/148910 "2018-09-18T03:30:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![logstashleaner](https://avatars.discourse-cdn.com/v4/letter/l/94ad74/32.png) [@logstashleaner](https://discuss.elastic.co/u/logstashleaner)\
**Post date:** [September 18, 2018, 3:30am UTC](https://discuss.elastic.co/t/help-with-logstash-config/148910/1 "2018-09-18T03:30:37Z")

</div>

Hello,

I need some help in how we can parse logs in the following format. Have been trying using grok and csv but have not been able to parse the logs.

Any help will be really helpful.

{"ts":"2018-09-17T11:04:14.763","pid":27360,"tid":"69bc","sev":"info","req":"-","sess":"-","site":"{A07C2521-8B1E-4952-9FF1-F0E4AD54EC77}","user":"-","k":"begin-query","v":{"protocol-id":-1,"query":"SELECT ""."" AS ""\nFROM ""."" ""\n INNER JOIN ""."" "" ON ((""","query-category":"Unknown","query-hash":1449155313},"ctx":{"client-type":"dataserver","procid":"14888","requestID":"W5-CZWnpDdBwrsK9OUbR8gAAA@E","sessionid":"2B19A8A0D77E4C3AB34C81238C87F881-1:0","tid":"20548","username":"abc@temp.com"}}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 18, 2018, 6:34am UTC](https://discuss.elastic.co/t/help-with-logstash-config/148910/2 "2018-09-18T06:34:20Z")

</div>

That's a JSON string so you should use a json filter or possibly json or json\_lines codec to parse it.

---

<div class="post-metadata">

**Author:** ![logstashleaner](https://avatars.discourse-cdn.com/v4/letter/l/94ad74/32.png) [@logstashleaner](https://discuss.elastic.co/u/logstashleaner)\
**Post date:** [September 18, 2018, 10:18pm UTC](https://discuss.elastic.co/t/help-with-logstash-config/148910/3 "2018-09-18T22:18:14Z")

</div>

Thanks a lot! That helped.

I have another issue now, so for case where there is a json message inside a json message

The fields get split as  
ctx.tid,  
ctx.username  
v.query-category  
v.query-hash

and so on...

If i have to update any of the field or remove any of the field if i use ctx.tid or ctx.username it does now work

could you please help me with how to work with fields which are json within a json

---

<div class="post-metadata">

**Author:** ![logstashleaner](https://avatars.discourse-cdn.com/v4/letter/l/94ad74/32.png) [@logstashleaner](https://discuss.elastic.co/u/logstashleaner)\
**Post date:** [September 18, 2018, 10:49pm UTC](https://discuss.elastic.co/t/help-with-logstash-config/148910/4 "2018-09-18T22:49:25Z")

</div>

Got it from your comments form another post by someone  
had to access it as [v][query-category] and so on

Thanks again!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2018, 10:49pm UTC](https://discuss.elastic.co/t/help-with-logstash-config/148910/5 "2018-10-16T22:49:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.