# How to flatten the json, not working with previous post **URL:** \ **Category:** Logstash\ **Created:** [March 8, 2020, 3:14pm UTC](https://discuss.elastic.co/t/how-to-flatten-the-json-not-working-with-previous-post/222608 "2020-03-08T15:14:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![rkhapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkhapre/32/48333_2.png) [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Post date:** [March 8, 2020, 3:14pm UTC](https://discuss.elastic.co/t/how-to-flatten-the-json-not-working-with-previous-post/222608/1 "2020-03-08T15:14:59Z")
Hi All I have a case, wherein i need to flatten the json data.To get started i am just following the previous post. But i am not successful with the result > [@Indent any json file nested fields and make it flat](https://discuss.elastic.co/t/indent-any-json-file-nested-fields-and-make-it-flat/194447/2): > > You will need a ruby script. Create a file called flattenJSON.rb that contains def register(params) @field = params['field'] end def flatten(object, name, event) if object if object.kind\_of?(Hash) and object != {} object.each { |k, v| flatten(v, "#{name}.#{k}", event) } else event.set(name, object) end end end def filter(event) o = event.get(@field) if o flatten(o, @field, event) end event.remove(@field) [… I am getting below result ``` { "@timestamp" : "2020-03-08T15:09:09.688Z", "message" : " \"input\": {\r", "@version" : "1", "path" : "/bin/file_data/json_data.json", "host" : "xxxx", "type" : "json" }{ "@timestamp" : "2020-03-08T15:09:09.698Z", "message" : " \"information\": {\r", "@version" : "1", "path" : "/bin/file_data/json_data.json", "host" : "xxxxx", "type" : "json" }{ "@timestamp" : "2020-03-08T15:09:09.698Z", "message" : " \"value\": {\r", "@version" : "1", "path" : "/bin/file_data/json_data.json", "host" : "xxxxx", "type" : "json" }{ "@timestamp" : "2020-03-08T15:09:09.708Z", "message" : " \"AVB\"\r", "@version" : "1", "path" : "/bin/file_data/json_data.json", "host" : "xxxxx", "type" : "json" } ..... ``` This is my conf file > input{ > file { > path =\> "/bin/file\_data/json\_data.json" > sincedb\_path =\> "/bin/file\_data/sincedb.txt" > type =\> "json" > start\_position =\> "beginning" > } > } > > filter { > > ruby { > path =\> '/flattenJSON.rb' > script\_params =\> { field =\> "body" } > > } > > } > > output { > file { > path =\> "/test/test.json" > } > } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 8, 2020, 3:21pm UTC](https://discuss.elastic.co/t/how-to-flatten-the-json-not-working-with-previous-post/222608/2 "2020-03-08T15:21:37Z")
You appear to have a file containing a pretty-printed JSON object. You will need to use a multiline codec to consume it. Take a look at [this](https://discuss.elastic.co/t/parsing-array-of-json-objects-with-logstash-and-injesting-to-elastic/203197/2). ---
**Author:** ![rkhapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkhapre/32/48333_2.png) [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Post date:** [March 8, 2020, 3:39pm UTC](https://discuss.elastic.co/t/how-to-flatten-the-json-not-working-with-previous-post/222608/3 "2020-03-08T15:39:13Z")
Okay, i tried with single line json file, i got some improvement, but still no result `Below is my result > {"body" :{"BlockName":"SA","input" : {"type" :"array","identification" :"iValue","configs" : {},"information" : {"location" :"Users\\files\\","client\_id" : "abd"},"value" : {"info" :["Apple","MSFT", "AVB"],"domains" : ,"uniqueId" : "1108738857225224193","restul\_set" : [0.4112226366996765, 0.34098902344703674, 0.24778836965560913],"timestamp" :1554940800000,"text" :"Test Text"}}},"result" :0.06} My expectation is to get the data like this > body.BlockName: SA > body.input.type: array > body.input.identification: iValue > > ..... ` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 8, 2020, 3:56pm UTC](https://discuss.elastic.co/t/how-to-flatten-the-json-not-working-with-previous-post/222608/4 "2020-03-08T15:56:09Z")
OK, so you need a [json](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html) filter. ---
**Author:** ![rkhapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkhapre/32/48333_2.png) [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Post date:** [March 8, 2020, 4:02pm UTC](https://discuss.elastic.co/t/how-to-flatten-the-json-not-working-with-previous-post/222608/5 "2020-03-08T16:02:58Z")
okay i added the json file, then also same result, i am not getting the flattened json as mentioned in that post i am using version, 6.8.4 ``` json { source => "message" target => "message" } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 8, 2020, 6:08pm UTC](https://discuss.elastic.co/t/how-to-flatten-the-json-not-working-with-previous-post/222608/6 "2020-03-08T18:08:41Z")
Try 'target =\> "body"'. ---
**Author:** ![rkhapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkhapre/32/48333_2.png) [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Post date:** [March 8, 2020, 6:38pm UTC](https://discuss.elastic.co/t/how-to-flatten-the-json-not-working-with-previous-post/222608/7 "2020-03-08T18:38:52Z")
it worked.Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 5, 2020, 6:38pm UTC](https://discuss.elastic.co/t/how-to-flatten-the-json-not-working-with-previous-post/222608/8 "2020-04-05T18:38:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.