# How to add all elements in an array from json objects as fields in logstash
**URL:** https://discuss.elastic.co/t/how-to-add-all-elements-in-an-array-from-json-objects-as-fields-in-logstash/124549
**Category:** Logstash
**Created:** [March 19, 2018, 11:56am UTC](https://discuss.elastic.co/t/how-to-add-all-elements-in-an-array-from-json-objects-as-fields-in-logstash/124549 "2018-03-19T11:56:14Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Sunil\_Villuri](https://discuss.elastic.co/u/Sunil_Villuri)
#### Post date: [March 19, 2018, 11:56am UTC](https://discuss.elastic.co/t/how-to-add-all-elements-in-an-array-from-json-objects-as-fields-in-logstash/124549/1 "2018-03-19T11:56:15Z")
Sample :
"message": [
"key1" : "value1",
"key2" : "value2",
"key3" : "value3",
"key4" : "value4",
"key5" : "value5",
"keyn" : "valuen"
]
i need to create the Additional Fields from each and every key in the message.Could some one help me out for this ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 19, 2018, 1:20pm UTC](https://discuss.elastic.co/t/how-to-add-all-elements-in-an-array-from-json-objects-as-fields-in-logstash/124549/2 "2018-03-19T13:20:55Z")
Your example isn't valid JSON. What does `message` actually contain?
---
### Author:  [@Sunil\_Villuri](https://discuss.elastic.co/u/Sunil_Villuri)
#### Post date: [March 19, 2018, 3:22pm UTC](https://discuss.elastic.co/t/how-to-add-all-elements-in-an-array-from-json-objects-as-fields-in-logstash/124549/3 "2018-03-19T15:22:30Z")
Hi Magnus,
my json object will be like this
{
"\_index": "sample-log2018.03.19",
"\_type": "cisco\_logs",
"\_id": "AEq-PmIBDCdfr1MDAWGD",
"\_version": 1,
"\_score": null,
"\_source": {
"@version": "1",
"message": "CISCO log message",
}
i passed the Cisco log message to mutate -split to convert the string message into Array object.
mutate {
split =\> { "message" =\> ","}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 19, 2018, 3:26pm UTC](https://discuss.elastic.co/t/how-to-add-all-elements-in-an-array-from-json-objects-as-fields-in-logstash/124549/4 "2018-03-19T15:26:15Z")
But in this case `message` doesn't contain any commas so I'd expect us to end up with an array with one element. Right? And what do you want to do with that?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 19, 2018, 4:41pm UTC](https://discuss.elastic.co/t/how-to-add-all-elements-in-an-array-from-json-objects-as-fields-in-logstash/124549/7 "2018-03-19T16:41:58Z")
I would start with something like
```auto
dissect { mapping => { "message" => "%{ts} %{+ts} %{+ts} %{foo} %{bar}: %{therest}" } }
kv { source => "therest" field_split => "," value_split => ":" trim_key => " " }
```
---
### Author:  [@Sunil\_Villuri](https://discuss.elastic.co/u/Sunil_Villuri)
#### Post date: [March 19, 2018, 6:00pm UTC](https://discuss.elastic.co/t/how-to-add-all-elements-in-an-array-from-json-objects-as-fields-in-logstash/124549/8 "2018-03-19T18:00:55Z")
Hi Badger,
Am i suppose to use the same code in my configuration file which you provided, ae do i need to perform any changes according to my text.
Could you please provide some useful links for disset plugin and how to use it
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 19, 2018, 8:25pm UTC](https://discuss.elastic.co/t/how-to-add-all-elements-in-an-array-from-json-objects-as-fields-in-logstash/124549/9 "2018-03-19T20:25:57Z")
The documentation for dissect is [here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 16, 2018, 8:37pm UTC](https://discuss.elastic.co/t/how-to-add-all-elements-in-an-array-from-json-objects-as-fields-in-logstash/124549/10 "2018-04-16T20:37:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.