# How to extract data from Json

**URL:** <https://discuss.elastic.co/t/how-to-extract-data-from-json/252595>\
**Category:** Logstash\
**Created:** [October 19, 2020, 7:12pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-json/252595 "2020-10-19T19:12:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rildo](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@rildo](https://discuss.elastic.co/u/rildo)\
**Post date:** [October 19, 2020, 7:12pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-json/252595/1 "2020-10-19T19:12:48Z")

</div>

```auto
input {

stdin { }

}

output { stdout { codec => rubydebug } }

filter {

json {

source => "message"

}

mutate {

gsub => ["message" , "\n", ","] }

 

mutate {

gsub => ["message" , "[\]", "" ]

gsub => ["other_logs" , "[\\n]", "," ]

split => ["other_logs" , ","]

add_field => { "Client SSH" => "%{[other_logs][2]}" }

add_field => { "User" => "%{[other_logs][3]}" }

add_field => { "Password" => "%{[other_logs][4]}" }

}

}

```

My output is something like that

```auto
"aka_vulnerability" => false,

"Password" => "Password:packet",

"Client SSH" => "Client SSH:SSH-2.0-libssh-0.6.3",

"service" => "ssh",

"timestamp" => "2020-07-02 08:00:10",

"host" => "xyz",

"@version" => "1",

"target_ips" => {

"1.1.1.1" => {

"port" => "22"

}

},

"message" => "{"aka_vulnerability": false, "service": "ssh", "timestamp": "2020-07-02 08:00:10", "target_ips": {"1.1.1.1": {"port": "22"}}, "source_ip": "2.2.2.2", "other_logs": "Start Attack:"2020-07-02 08:00:10"nEnd Attack:"2020-07-02 08:00:10"nClient SSH:SSH-2.0-libssh-0.6.3nUser:packetnPassword:packet", "source_hostname": "-", "source_port": "11818", "subject": "Brute Force"}",

"subject" => "Brute Force",

"User" => "User:packet",

"source_hostname" => "-",

"other_logs" => [

[0] "Start Attack:"2020-07-02 08:00:10"",

[1] "End Attack:"2020-07-02 08:00:10"",

[2] "Client SSH:SSH-2.0-libssh-0.6.3",

[3] "User:packet",

[4] "Password:packet"

],

```

I would like to know how is possible to extract the fields inside the "target\_ips"

Thank you

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 19, 2020, 7:36pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-json/252595/2 "2020-10-19T19:36:43Z")

</div>

> [@rildo](#):
>
> I would like to know how is possible to extract the fields inside the "target\_ips"

What do you mean by that? What do you want the fields to look like?

---

<div class="post-metadata">

**Author:** ![rildo](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@rildo](https://discuss.elastic.co/u/rildo)\
**Post date:** [October 19, 2020, 11:14pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-json/252595/3 "2020-10-19T23:14:29Z")

</div>

I would like to extract the target\_ips fields and put it another fields something like that

"Destiny IP" =\> " 1.1.1.1"  
"Destiny Port" =\> "22"

I tried to do it, but doesn't work

```auto
mutate { 
    add_field => { "Destiny IP" => "%{[target_ips][0]}" }
    add_field => { "Destiny Port" => "%{[target_ips][1]}" }
        }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 19, 2020, 11:26pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-json/252595/4 "2020-10-19T23:26:00Z")

</div>

[target\_ips] is not an array, it is a hash, so you cannot refer to it as

```
[target_ips][0]

```

If, when there are multiple targets it switches to an array of hashes you would need more complicated code, but I would start with something like

```
ruby
    code => '
        t = event.get("target_ips")
        t.each { |k, v|
            event.set("dstIp", k)
            event.set("dstPort", v["port"])
        }
    '
}
```

---

<div class="post-metadata">

**Author:** ![rildo](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@rildo](https://discuss.elastic.co/u/rildo)\
**Post date:** [October 20, 2020, 12:25pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-json/252595/5 "2020-10-20T12:25:36Z")

</div>

Badger,

Thank you a lot , it worked perfectly .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2020, 12:25pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-json/252595/6 "2020-11-17T12:25:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.