# How to add root level field in logstash json output

**URL:** <https://discuss.elastic.co/t/how-to-add-root-level-field-in-logstash-json-output/185010>\
**Category:** Logstash\
**Created:** [June 10, 2019, 3:33pm UTC](https://discuss.elastic.co/t/how-to-add-root-level-field-in-logstash-json-output/185010 "2019-06-10T15:33:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rahulkothanath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahulkothanath/32/99122_2.png) [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\
**Post date:** [June 10, 2019, 3:33pm UTC](https://discuss.elastic.co/t/how-to-add-root-level-field-in-logstash-json-output/185010/1 "2019-06-10T15:33:05Z")

</div>

My logstash output is like this

```
{
"a":"b",
"c":"d"
}

```

I want to add a new field called parent as a root to this existing json like below:

```
   {   
        "parent":{
            "a":"b",
            "c":"d"
            }
        }

```

How to add a new field as root level in logstash? can i do it inside filter plugin ?

thanks for reading and helping...

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 10, 2019, 5:41pm UTC](https://discuss.elastic.co/t/how-to-add-root-level-field-in-logstash-json-output/185010/2 "2019-06-10T17:41:15Z")

</div>

You could do that in a ruby filter

```
    ruby {
        init => ' Exceptions = ["@timestamp", "@version", "host", "message", "sequence", "version"] '
        code => '
            event.to_hash.each { |k, v|
                unless Exceptions.include? k
                    event.set("[parent][#{k}]", v)
                    event.remove(k)
                end
            }
        '
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 8, 2019, 5:41pm UTC](https://discuss.elastic.co/t/how-to-add-root-level-field-in-logstash-json-output/185010/3 "2019-07-08T17:41:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.