# How can i convert to complex json file **URL:** \ **Category:** Logstash\ **Created:** [April 15, 2019, 9:51am UTC](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874 "2019-04-15T09:51:48Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![newface](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/newface/32/44141_2.png) [@newface](https://discuss.elastic.co/u/newface)\ **Post date:** [April 15, 2019, 9:51am UTC](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874/1 "2019-04-15T09:51:48Z")
Hello i try a complex json using split plugin But, the result is not my intent. Json file is like this. ``` { "col1" : "0C35C", "col2" : 0, "col3" : "was", "col4" : "AAF", "col5" : "20190329", "col6" : [ {"test1":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0","test2":"/test/test.img","test3":"/favicon.ico","test4":1553827094.070707,"test5":"16.21.57.7","test6":4448}, {"test1":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0","test2":"/test/test.img","test3":"/favicon.ico","test4":1553827094.070707,"test5":"161.178.2.54","test6":48} ] } ``` Logstash config is like this. ``` input { file { path => "/tmp/test.json" start_position => "beginning" sincedb_path => "/dev/null" codec => "json" } } filter { json { source => "message" } split { field => "col6" } } output { stdout {} } ``` and result is ... ``` { "test1" => "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0", "@version" => "1", "host" => "kafka.novalocal", "test3" => "/favicon.ico", "@timestamp" => 2019-04-15T09:50:24.289Z, "test2" => "/test/test.img", "test5" => "161.178.2.54", "test4" => 1553827094.070707, "tags" => [ [0] "_split_type_failure" ], "test6" => 48, "path" => "/tmp/test.json" } { "test1" => "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0", "@version" => "1", "host" => "kafka.novalocal", "test3" => "/favicon.ico", "@timestamp" => 2019-04-15T09:50:24.287Z, "test2" => "/test/test.img", "test5" => "16.21.57.7", "test4" => 1553827094.070707, "tags" => [ [0] "_split_type_failure" ], "test6" => 4448, "path" => "/tmp/test.json" } { "@timestamp" => 2019-04-15T09:50:24.273Z, "message" => "{", "@version" => "1", "tags" => [ [0] "_jsonparsefailure", [1] "_split_type_failure" ], "host" => "kafka.novalocal", "path" => "/tmp/test.json" } { "@timestamp" => 2019-04-15T09:50:24.282Z, "message" => " \"col5\" : \"20190329\",", "@version" => "1", "tags" => [ [0] "_jsonparsefailure", [1] "_split_type_failure" ], "host" => "kafka.novalocal", "path" => "/tmp/test.json" } { "@timestamp" => 2019-04-15T09:50:24.276Z, "message" => " \"col1\" : \"0C35C\",", "@version" => "1", "tags" => [ [0] "_jsonparsefailure", [1] "_split_type_failure" ], "host" => "kafka.novalocal", "path" => "/tmp/test.json" } { "@timestamp" => 2019-04-15T09:50:24.291Z, "message" => " ]", "@version" => "1", "tags" => [ [0] "_jsonparsefailure", [1] "_split_type_failure" ], "host" => "kafka.novalocal", "path" => "/tmp/test.json" } { "@timestamp" => 2019-04-15T09:50:24.281Z, "message" => " \"col4\" : \"AAF\",", "@version" => "1", "tags" => [ [0] "_jsonparsefailure", [1] "_split_type_failure" ], "host" => "kafka.novalocal", "path" => "/tmp/test.json" } { "@timestamp" => 2019-04-15T09:50:24.293Z, "message" => "}", "@version" => "1", "tags" => [ [0] "_jsonparsefailure", [1] "_split_type_failure" ], "host" => "kafka.novalocal", "path" => "/tmp/test.json" } { "@timestamp" => 2019-04-15T09:50:24.279Z, "message" => " \"col3\" : \"was\",", "@version" => "1", "tags" => [ [0] "_jsonparsefailure", [1] "_split_type_failure" ], "host" => "kafka.novalocal", "path" => "/tmp/test.json" } { "@timestamp" => 2019-04-15T09:50:24.283Z, "message" => " \"col6\" : [", "@version" => "1", "tags" => [ [0] "_jsonparsefailure", [1] "_split_type_failure" ], "host" => "kafka.novalocal", "path" => "/tmp/test.json" } { "@timestamp" => 2019-04-15T09:50:24.278Z, "message" => " \"col2\" : 0,", "@version" => "1", "tags" => [ [0] "_jsonparsefailure", [1] "_split_type_failure" ], "host" => "kafka.novalocal", "path" => "/tmp/test.json" } ``` How can is solve this problem? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 15, 2019, 10:50am UTC](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874/2 "2019-04-15T10:50:26Z")
You are already decoding the message using the codec, so why have a separate JSON filter? ---
**Author:** ![newface](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/newface/32/44141_2.png) [@newface](https://discuss.elastic.co/u/newface)\ **Post date:** [April 15, 2019, 11:03am UTC](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874/3 "2019-04-15T11:03:31Z")
Thanks your help. But, even if remove the JSON filter, problem is not solved. In my opinion, the JSON filter is unnecessary, but it is not the cause of the problem. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 15, 2019, 11:12am UTC](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874/4 "2019-04-15T11:12:56Z")
Your data does not seem to have any col6 field. What does the input look like? You may want to add a conditional around the split filter and only perform this if the assumed field is present. ---
**Author:** ![newface](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/newface/32/44141_2.png) [@newface](https://discuss.elastic.co/u/newface)\ **Post date:** [April 15, 2019, 11:22am UTC](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874/5 "2019-04-15T11:22:30Z")
'col6' is exist. Json file is like this. ``` { "col1" : "0C35C", "col2" : 0, "col3" : "was", "col4" : "AAF", "col5" : "20190329", " **col6**" : [ {"test1":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0","test2":"/test/test.img","test3":"/favicon.ico","test4":1553827094.070707,"test5":"16.21.57.7","test6":4448}, {"test1":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0","test2":"/test/test.img","test3":"/favicon.ico","test4":1553827094.070707,"test5":"161.178.2.54","test6":48} ] } ``` And i want these results Is it possible to parse this way? ``` { "col1" : "0C35C", "col2" : 0, "col3" : "was", "col4" : "AAF", "col5" : "20190329", "test1":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0", "test2":"/test/test.img", "test3":"/favicon.ico", "test4":1553827094.070707, "test5":"16.21.57.7", "test6":4448 } { "col1" : "0C35C", "col2" : 0, "col3" : "was", "col4" : "AAF", "col5" : "20190329", "test1":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0", "test2":"/test/test.img", "test3":"/favicon.ico", "test4":1553827094.070707, "test5":"161.178.2.54", "test6":48 } ``` ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 15, 2019, 11:25am UTC](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874/6 "2019-04-15T11:25:10Z")
It did not seem to exist in the results you posted above. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 15, 2019, 11:26am UTC](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874/7 "2019-04-15T11:26:55Z")
You need to use a multiline codec to combine all the lines from a single JSON object into one event. Is there more than one object in a file? ---
**Author:** ![newface](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/newface/32/44141_2.png) [@newface](https://discuss.elastic.co/u/newface)\ **Post date:** [April 16, 2019, 1:28am UTC](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874/8 "2019-04-16T01:28:35Z")
Thanks your comment A json file have just only one object. And i solved the problem through the way you comment me. (I combined all the lines into a single event with a multiline codec and then parsed it.) Have a good day~ ---
**Author:** ![newface](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/newface/32/44141_2.png) [@newface](https://discuss.elastic.co/u/newface)\ **Post date:** [April 16, 2019, 1:38am UTC](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874/9 "2019-04-16T01:38:02Z")
The problem is solved. Thank you for reviewing my problem together. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 14, 2019, 1:43am UTC](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874/10 "2019-05-14T01:43:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.