# How do I read nested JSON?

**URL:** <https://discuss.elastic.co/t/how-do-i-read-nested-json/1775>\
**Category:** Logstash\
**Created:** [June 2, 2015, 8:08pm UTC](https://discuss.elastic.co/t/how-do-i-read-nested-json/1775 "2015-06-02T20:08:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Yeuk\_Hon\_Wong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_yeuk_hon_wong/32/493_2.png) [@John\_Yeuk\_Hon\_Wong](https://discuss.elastic.co/u/John_Yeuk_Hon_Wong)\
**Post date:** [June 2, 2015, 8:08pm UTC](https://discuss.elastic.co/t/how-do-i-read-nested-json/1775/1 "2015-06-02T20:08:21Z")

</div>

Hi.

Here is part of the JSON doc in Kibana after I use JSON filter to process incoming log.

```
    "OldStateValue": "INSUFFICIENT_DATA",
"Trigger": {
  "MetricName": "CPUUtilization",
  "Namespace": "AWS/EC2",
  "Statistic": "AVERAGE",
  "Unit": null,
  "Dimensions": [
    {
      "name": "InstanceId",
      "value": "i-9e0a8763"
    }
  ],
  "Period": 300,
  "EvaluationPeriods": 12,
  "ComparisonOperator": "GreaterThanThreshold",
  "Threshold": 95
}

```

I tried the followings with json filter;

```
source => "Trigger"
source => "Trigger.Dimensions"
source => "Trigger\.Dimensions"

```

But none of them work. Essentially I wanted to build a new field called InstanceId by reading the "value" kv from the inner JSON document of Trigger KV

In Python I am going to do TriggerObject["Dimensions"]["value"]. What's the syntax to read that in logstash?

Thanks.

---

<div class="post-metadata">

**Author:** ![rafaltrojniak](https://avatars.discourse-cdn.com/v4/letter/r/ecc23a/32.png) [@rafaltrojniak](https://discuss.elastic.co/u/rafaltrojniak)\
**Post date:** [June 4, 2015, 9:54pm UTC](https://discuss.elastic.co/t/how-do-i-read-nested-json/1775/2 "2015-06-04T21:54:25Z")

</div>

Hello @John_Yeuk_Hon_Wong ,  
To refer to nested field you have to use brackets (like [Trigger][Namespace] )  
That is documented here :  
[https://www.elastic.co/guide/en/logstash/current/configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/configuration.html#logstash-config-field-references)

---

<div class="post-metadata">

**Author:** ![JeremyinNC](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeremyinnc/32/44868_2.png) [@JeremyinNC](https://discuss.elastic.co/u/JeremyinNC)\
**Post date:** [September 3, 2015, 8:37pm UTC](https://discuss.elastic.co/t/how-do-i-read-nested-json/1775/3 "2015-09-03T20:37:28Z")

</div>

I don't see it in the link provided but try:

> [Trigger][Dimensions]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:30am UTC](https://discuss.elastic.co/t/how-do-i-read-nested-json/1775/4 "2017-07-06T05:30:11Z")

</div>