# How to create fields from nested fields for json data in logstash

**URL:** <https://discuss.elastic.co/t/how-to-create-fields-from-nested-fields-for-json-data-in-logstash/239369>\
**Category:** Logstash\
**Created:** [June 30, 2020, 7:24pm UTC](https://discuss.elastic.co/t/how-to-create-fields-from-nested-fields-for-json-data-in-logstash/239369 "2020-06-30T19:24:23Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 30, 2020, 8:42pm UTC](https://discuss.elastic.co/t/how-to-create-fields-from-nested-fields-for-json-data-in-logstash/239369/4 "2020-06-30T20:42:35Z")

</div>

It is not quite what you asked for, but should give you something to work with

```
    ruby {
        code => '
            def flattenObject(object, name, event)
                if object
                    if object.kind_of?(Hash) and object != {}
                        object.each { |k, v| flattenObject(v, "#{name}.#{k}", event) }
                    elsif object.kind_of?(Array) and object != []
                        object.each_index { |i|
                            flattenObject(object[i], name + "_#{i}", event)
                        }
                    else
                        event.set(name, object)
                    end
                end
            end

            fieldName = "service.action.portProbeAction.portProbeDetails"
            o = event.get(fieldName)
            if o
                flattenObject(o, fieldName, event)
            end
            event.remove(fieldName)
        '
    }

```

will produce

```
 "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.organization.asnOrg" => " ",
    "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.geoLocation.lat" => 20.7386,
"service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.country.countryName" => "Russia",
   "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.organization.org" => " ",
          "service.action.portProbeAction.portProbeDetails_0.localPortDetails.portName" => "HTTPS",
   "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.organization.isp" => " ",
"service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.country.countryName" => "us",
    "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.geoLocation.lon" => 8.6068,
    "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.geoLocation.lon" => -56.6068,
      "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.city.cityName" => "",
   "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.organization.isp" => " ",
   "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.organization.org" => " ",
"service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.organization.asnOrg" => " ",
          "service.action.portProbeAction.portProbeDetails_1.localPortDetails.portName" => "HTTP",
    "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.geoLocation.lat" => 21.7386,
      "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.city.cityName" => "",
   "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.organization.asn" => "49505",
        "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.ipAddressV4" => "76.98.213.56",
              "service.action.portProbeAction.portProbeDetails_1.localPortDetails.port" => 80,
   "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.organization.asn" => "49505",
        "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.ipAddressV4" => "76.98.213.56",
              "service.action.portProbeAction.portProbeDetails_0.localPortDetails.port" => 443,
```

---

_[View the full topic](https://discuss.elastic.co/t/how-to-create-fields-from-nested-fields-for-json-data-in-logstash/239369)._