# How changing root of json events with logstash filter?

**URL:** <https://discuss.elastic.co/t/how-changing-root-of-json-events-with-logstash-filter/282755>\
**Category:** Logstash\
**Created:** [August 29, 2021, 12:30pm UTC](https://discuss.elastic.co/t/how-changing-root-of-json-events-with-logstash-filter/282755 "2021-08-29T12:30:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![e-fo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e-fo/32/87474_2.png) [@e-fo](https://discuss.elastic.co/u/e-fo)\
**Post date:** [August 29, 2021, 12:30pm UTC](https://discuss.elastic.co/t/how-changing-root-of-json-events-with-logstash-filter/282755/1 "2021-08-29T12:30:15Z")

</div>

Hello,  
I have a problem with json events that importing into elasticsearch from logstash.  
events come from mongodb (with jdbc input plugin) and then imported into elasticsearch.

after importing events into logstash the json structure is like this json document:

```auto
     {
        "_index" : "bb_purchaselog_2021.08",
        "_type" : "_doc",
        "_id" : "IVYXeHsBHLpkNlM2tct_",
        "_score" : 1.0,
        "_source" : {
          "document" : {
            "user_trophy" : 1068.0,
            "transaction_revenue" : 200000.0,
            "user_name" : "Yah",
            "user_coin" : 635.0,
            "transaction_category" : "Direct",
            "user_level" : 7.0,
            "transaction_state" : "Valid",
            "@timestamp" : "2021-08-24T12:06:33.356Z",
            "user_xp" : 1345.0,
            "product_name" : "P3",
            "transaction_id" : "D9D0C400CC3A80D2E3CEE86C5C9D7E6B",
            "user_id" : "60e1e20c447ee7267be7e368",
            "user_gem" : 315.0,
            "transaction_time" : 1629806793356
          },
          "@timestamp" : "2021-08-24T12:17:04.006Z",
          "type" : "bb_purchaselog"
        }
      },

```

But logstash defines the root for my json documents as "\*\* document **", which I want to delete and put the root of the documents to "** \_ source \*\*", like this structure:

```auto
     {
        "_index" : "bb_purchaselog_2021.08",
        "_type" : "_doc",
        "_id" : "IVYXeHsBHLpkNlM2tct_",
        "_score" : 1.0,
        "_source" : {
		  "user_trophy" : 1068.0,
		  "transaction_revenue" : 200000.0,
		  "user_name" : "Yah",
		  "user_coin" : 635.0,
		  "transaction_category" : "Direct",
		  "user_level" : 7.0,
		  "transaction_state" : "Valid",
		  "@timestamp" : "2021-08-24T12:06:33.356Z",
		  "user_xp" : 1345.0,
		  "product_name" : "P3",
		  "transaction_id" : "D9D0C400CC3A80D2E3CEE86C5C9D7E6B",
		  "user_id" : "60e1e20c447ee7267be7e368",
		  "user_gem" : 315.0,
		  "transaction_time" : 1629806793356
          "@timestamp" : "2021-08-24T12:17:04.006Z",
          "type" : "bb_purchaselog"
        }
      },

```

How can I do this with filter stage plugins such as json or other plugins?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 29, 2021, 4:29pm UTC](https://discuss.elastic.co/t/how-changing-root-of-json-events-with-logstash-filter/282755/2 "2021-08-29T16:29:43Z")

</div>

Answered [here](https://discuss.elastic.co/t/how-to-dynamically-move-nested-key-value-to-root-level/180006/2).

---

<div class="post-metadata">

**Author:** ![e-fo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e-fo/32/87474_2.png) [@e-fo](https://discuss.elastic.co/u/e-fo)\
**Post date:** [August 30, 2021, 5:55am UTC](https://discuss.elastic.co/t/how-changing-root-of-json-events-with-logstash-filter/282755/3 "2021-08-30T05:55:23Z")

</div>

Thanks, it's works very well.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2021, 5:55am UTC](https://discuss.elastic.co/t/how-changing-root-of-json-events-with-logstash-filter/282755/4 "2021-09-27T05:55:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.