# How to extract a message JSON value using JSON Input under Kibana Visualization

**URL:** <https://discuss.elastic.co/t/how-to-extract-a-message-json-value-using-json-input-under-kibana-visualization/233690>\
**Category:** Kibana\
**Created:** [May 21, 2020, 7:32am UTC](https://discuss.elastic.co/t/how-to-extract-a-message-json-value-using-json-input-under-kibana-visualization/233690 "2020-05-21T07:32:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Post date:** [May 21, 2020, 7:32am UTC](https://discuss.elastic.co/t/how-to-extract-a-message-json-value-using-json-input-under-kibana-visualization/233690/1 "2020-05-21T07:32:02Z")

</div>

Below is the message that is captured in my logs and, as of no values/fields are getting extracted.

{"browser":"Edge","id":766415199,"status":"SessionCreated"}

Can I use JSON Input under Kibana visualization to extract each value and create a tabular visualization without extracting these fields ?

---

<div class="post-metadata">

**Author:** ![joshdover](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshdover/32/42020_2.png) [@joshdover](https://discuss.elastic.co/u/joshdover)\
**Post date:** [May 21, 2020, 7:46pm UTC](https://discuss.elastic.co/t/how-to-extract-a-message-json-value-using-json-input-under-kibana-visualization/233690/2 "2020-05-21T19:46:41Z")

</div>

It sounds like what you want is to use a [Scripted Field](https://www.elastic.co/guide/en/kibana/7.7/scripted-fields.html) in Kibana. Note that you cannot do aggregations on scripted fields, but you can use them to filter on.

If you do need to do aggregations, I recommend using a [Ingest Pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/7.7/ingest.html) in Elasticsearch which allows you to modify data before it is ingested. Once you have this working, you can reindex all of the documents to re-process the existing docs that were created before you configured the pipeline.

---

<div class="post-metadata">

**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Post date:** [May 21, 2020, 8:09pm UTC](https://discuss.elastic.co/t/how-to-extract-a-message-json-value-using-json-input-under-kibana-visualization/233690/3 "2020-05-21T20:09:22Z")

</div>

Due to our current project permissions, I won't be able to add scripted fields under Kibana. Just wanted to know if Json Input can be similar to scripted fields so that the fields are only created/generated at visualization time.

---

<div class="post-metadata">

**Author:** ![lukeelmers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukeelmers/32/35230_2.png) [@lukeelmers](https://discuss.elastic.co/u/lukeelmers)\
**Post date:** [May 25, 2020, 3:36pm UTC](https://discuss.elastic.co/t/how-to-extract-a-message-json-value-using-json-input-under-kibana-visualization/233690/4 "2020-05-25T15:36:34Z")

</div>

> Just wanted to know if Json Input can be similar to scripted fields so that the fields are only created/generated at visualization time.

This is correct, you can use the JSON input to add a scripted field "on the fly" to your visualization. You can find an example of this in my comment here:

> [@Kibana JSON Input Question](https://discuss.elastic.co/t/kibana-json-input-question/232895/2):
>
> Hi there, All that really happens with JSON inputs is that the JSON gets included along with the rest of the aggregation generated by the editor and sent to Elasticsearch. The [docs on aggregations](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations.html) explain the options for these in more detail, but we most commonly see folks using them to include inline scripts to run against the selected field, e.g. { "script": { "inline": "doc['name'].value ...whatever", "lang": "painless" } } The important thing to keep in mind is that these scri…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2020, 3:36pm UTC](https://discuss.elastic.co/t/how-to-extract-a-message-json-value-using-json-input-under-kibana-visualization/233690/5 "2020-06-22T15:36:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.