# How to extract JSON content in message to top level

**URL:** <https://discuss.elastic.co/t/how-to-extract-json-content-in-message-to-top-level/190422>\
**Category:** Logstash\
**Created:** [July 15, 2019, 4:19am UTC](https://discuss.elastic.co/t/how-to-extract-json-content-in-message-to-top-level/190422 "2019-07-15T04:19:14Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![justAbeginner](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@justAbeginner](https://discuss.elastic.co/u/justAbeginner)\
**Post date:** [July 15, 2019, 4:19am UTC](https://discuss.elastic.co/t/how-to-extract-json-content-in-message-to-top-level/190422/1 "2019-07-15T04:19:14Z")

</div>

Sorry if it is a duplicated post.  
I have been searching google and the forum for answer, however I still could not find it.  
It would be nice if someone can direct me to the answer if it is duplicated.

I am currently using Logstash to receive some of my logs via UDP and save it to the file.  
The content sent to Logstash is as follow:

> {  
> "key1":"value1",  
> "key2":"value2",  
> "key3":"value3",  
> "key4":"value4"  
> }

and in my output file looks like:

> {  
> "message": {  
> "key1":"value1",  
> "key2":"value2",  
> "key3":"value3",  
> "key4":"value4"  
> },  
> "@timestamp":"....."  
> }

desired output file:

> {  
> "key1":"value1",  
> "key2":"value2",  
> "key3":"value3",  
> "key4":"value4",  
> "@timestamp":"....."  
> }

I am hoping to extract all key and value to the top level rather than storing in message.  
I am aware I can use mutate.addfield but that means if I have 50 key, my add\_field would have 50 entry.

> mutate {  
> add\_field =\> {  
> "key1" =\> "%{[message][key1]}"  
> }  
> }

I am looking for a better solution to it, so that all key in message can be extracted to the top level.  
I am currently using Logstash 6.4.2

From what I have now in my filter without add\_field:

> filter {  
> json {  
> source =\> "message"  
> target =\> "message"  
> }  
> mutate {  
> remove\_field =\> ["tags","@version","host"]  
> }  
> }

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 15, 2019, 4:33am UTC](https://discuss.elastic.co/t/how-to-extract-json-content-in-message-to-top-level/190422/2 "2019-07-15T04:33:59Z")

</div>

What does your current config look like given that you end up with the keys under message?

---

<div class="post-metadata">

**Author:** ![justAbeginner](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@justAbeginner](https://discuss.elastic.co/u/justAbeginner)\
**Post date:** [July 15, 2019, 4:39am UTC](https://discuss.elastic.co/t/how-to-extract-json-content-in-message-to-top-level/190422/3 "2019-07-15T04:39:07Z")

</div>

My current full config is like this:

> input {  
> udp {  
> port =\> 6578  
> }  
> }
> 
> filter {  
> json {  
> source =\> "message"  
> target =\> "message"  
> }  
> mutate {  
> remove\_field =\> ["tags","@version","host"]  
> }  
> }
> 
> output {  
> file {  
> codec =\> json\_lines  
> path =\> "/data/parse.log"  
> }  
> }

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 15, 2019, 4:40am UTC](https://discuss.elastic.co/t/how-to-extract-json-content-in-message-to-top-level/190422/4 "2019-07-15T04:40:17Z")

</div>

Remove the target parameter in the JSON filter. That should put extracted fields at the root level.

---

<div class="post-metadata">

**Author:** ![justAbeginner](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@justAbeginner](https://discuss.elastic.co/u/justAbeginner)\
**Post date:** [July 15, 2019, 4:47am UTC](https://discuss.elastic.co/t/how-to-extract-json-content-in-message-to-top-level/190422/5 "2019-07-15T04:47:00Z")

</div>

I think logstash just stop writing out data received. I dont see error messages from logstash log.

> tail /var/log/logstash/logstash-plain.log

---

<div class="post-metadata">

**Author:** ![justAbeginner](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@justAbeginner](https://discuss.elastic.co/u/justAbeginner)\
**Post date:** [July 16, 2019, 7:50am UTC](https://discuss.elastic.co/t/how-to-extract-json-content-in-message-to-top-level/190422/6 "2019-07-16T07:50:17Z")

</div>

bump

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2019, 7:50am UTC](https://discuss.elastic.co/t/how-to-extract-json-content-in-message-to-top-level/190422/7 "2019-08-13T07:50:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.