# How to fetch nested json data in separate fields

**URL:** <https://discuss.elastic.co/t/how-to-fetch-nested-json-data-in-separate-fields/343701>\
**Category:** Elasticsearch\
**Created:** [September 25, 2023, 5:08am UTC](https://discuss.elastic.co/t/how-to-fetch-nested-json-data-in-separate-fields/343701 "2023-09-25T05:08:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bharti](https://avatars.discourse-cdn.com/v4/letter/b/73ab20/32.png) [@bharti](https://discuss.elastic.co/u/bharti)\
**Post date:** [September 25, 2023, 5:08am UTC](https://discuss.elastic.co/t/how-to-fetch-nested-json-data-in-separate-fields/343701/1 "2023-09-25T05:08:29Z")

</div>

Hello  
I need a little help.  
I want to fetch some nested json data into separate fields

```auto
input {
  beats {
    port => 5044
  }
}
filter {
    if "/var/log/ABC.log" in [log][file][path] {
      grok {
         match => { "message" => '^%{GREEDYDATA}"Status":"%{WORD:Status}"%{GREEDYDATA}$' }
      }

     grok {
        match => { "message" => '^%{GREEDYDATA}"TransactionNumber":"%{NUMBER:TransactionNumber}"%{GREEDYDATA}$' }

     }
     grok {
        match => { "message" => '^%{GREEDYDATA}"CountryCode":"%{WORD:CountryCode}"%{GREEDYDATA}$' }

     }
     grok {
        match => { "message" => '^%{GREEDYDATA}"RequestID":"%{WORD:RequestID}"%{GREEDYDATA}$' }

     }
     grok {
        match => { "message" => '^%{GREEDYDATA}"Amount":"%{NUMBER:Amount}"%{GREEDYDATA}$' }

     }
     grok {
        match => { "message" => '^%{GREEDYDATA}"SubCategory":"%{WORD:SubCategory}"%{GREEDYDATA}$' }

     }
     grok {
        match => { "message" => '^%{GREEDYDATA}"CustomerID":"%{WORD:CustomerID}"%{GREEDYDATA}$' }

     }
     grok {
        match => { "message" => '^%{GREEDYDATA}"CustomerNumber":"%{WORD:CustomerNumber}"%{GREEDYDATA}$' }

     }
 }
}

```

above is my logstash config

---

<div class="post-metadata">

**Author:** ![bharti](https://avatars.discourse-cdn.com/v4/letter/b/73ab20/32.png) [@bharti](https://discuss.elastic.co/u/bharti)\
**Post date:** [September 25, 2023, 5:23am UTC](https://discuss.elastic.co/t/how-to-fetch-nested-json-data-in-separate-fields/343701/2 "2023-09-25T05:23:02Z")

</div>

My sample json

{"Tksp":{"ServiceInterface":{"Channel":{"HostIP":{"Type":"IPV4","Value":"0.0.0.0"}},  
"Name":"[ABC.COM](http://ABC.COM)","Type":"AGENT"},"Device":{"IP":{},"OS":"web","Version":"117"},  
"Name":"ABC","Type":"TRANSACTION",  
"Response":{"Code":"0","Message":"SUCCESS","Status":"PENDING","HostCode":"17","HostMessage":"authentication required",  
"Parameter":  
[{"Name":"responseData",  
"Value":"{"authenticationsRequired":[{"authToken":"abcd-1234-xyz","message":"Enter the otp code send to the customer"}"},  
{"Name":"transactionId","Value":"null"},{"Name":"authenticationRequestID","Value":"fund\_transferd12345"}]}},  
"Security":{},"TransactionData":{"CountryCode":"AB","Currency":"INR","CustomerDetails":{"Operator":"ABC XYZ","Name":"DEF JKL",  
"TerminalId":"098765","TerminalLocation":",","CountryCode":"AB","AgentId":"12345","CreditAcctNumber":"1234567890","DebitAcctNumber":"1234567890",  
"CardNumber":"123456","AuthPerformed":"otp","AuthResult":"FAILED","BioenrollFlag":false,"BioenrollStat":false,"BioenrollDate":"",  
},  
"GLAgent":{"Commission":"0","Discount":"0","Fee":"0","STax":"0","SurCharge":"0","TotalAmount":"12000","VAT":"0","Formulae":"AMT","LedgerOperation":"DR"},  
"RequestID":"12345678998765432","ServiceDetail":{"BusinessCategory":"B2B","Denomination":"AB","Partner":"ABC",  
"SubCategory":"TRANSFER","UserType":"AGENT"},"TimeStamp":"22-09-2023 05:28:07AM","TransactionDescription":"Transfer",  
"TransactionNumber":"9876543212345677",  
"HistoryTransactionNumber":"dRa8uPPCaK0qCC4l4TVS1fjc5LIxWAJTPCAy8rs1SkchZwjgTWNQ7Ydj9Q3qRU3AKv/qS/FeL7gMb8IzMtmu9A==","Amount":"12000",  
"TransactionType":"TRANSFER\_EMPLOYEE","TransactionChannel":"AGENT","LanguageCode":"EN","origTxnId":""}}}

there is one Response json there within the whole json  
so I want that response data in separate fields like  
code  
Message  
HostCode  
Status  
HostMessage

need this separately  
please help me out

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 23, 2023, 5:23am UTC](https://discuss.elastic.co/t/how-to-fetch-nested-json-data-in-separate-fields/343701/3 "2023-10-23T05:23:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.