# How to get all the source from json that indexed with logstash

**URL:** <https://discuss.elastic.co/t/how-to-get-all-the-source-from-json-that-indexed-with-logstash/222590>\
**Category:** Logstash\
**Created:** [March 8, 2020, 8:26am UTC](https://discuss.elastic.co/t/how-to-get-all-the-source-from-json-that-indexed-with-logstash/222590 "2020-03-08T08:26:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bahadir\_Eyuboglu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bahadir_eyuboglu/32/64010_2.png) [@Bahadir\_Eyuboglu](https://discuss.elastic.co/u/Bahadir_Eyuboglu)\
**Post date:** [March 8, 2020, 8:26am UTC](https://discuss.elastic.co/t/how-to-get-all-the-source-from-json-that-indexed-with-logstash/222590/1 "2020-03-08T08:26:19Z")

</div>

I'm newbie and i need index large json data to elasticsearch so i use logstash to index my json files in some directory here is the logstash config:  
\<  
input {  
file {  
path =\> "/home/abahadir/Desktop/Proje/searchflask/elasticsearch/\*.json"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
codec =\> multiline { pattern =\> "^}" negate =\> true what =\> next auto\_flush\_interval =\> 1 }  
}  
}

output {  
elasticsearch {  
hosts =\> "[http://localhost:9200](http://localhost:9200)"  
index =\> "restaurants"  
document\_type =\> "docket"  
document\_id =\> "%{[path]}"  
}  
stdout{ codec =\> rubydebug }  
}  
/\>

here is the simple macth\_all query to check my data indexed

resp2 = es.search(index="restaurants", doc\_type="docket",body={ "query": { "match\_all": { } }})

and when i printed it this is the result i get

\<  
{u'hits': {u'hits': [{u'\_score': 1.0, u'\_type': u'docket', u'\_id': u'/home/abahadir/Desktop/Proje/searchflask/elasticsearch/DCMs.json', u'\_source': {u'tags': [u'multiline'], u'@timestamp': u'2020-03-08T08:12:05.185Z', u'host': u'abahadir-Lenovo-Y520-15IKBN', u'path': u'/home/abahadir/Desktop/Proje/searchflask/elasticsearch/DCMs.json', u'message': u' "DICOM\_QR\_SCP"\n ]\n },\n "0018A002": {\n "vr": "DT",\n "Value": [\n "20190509151148"\n]\n },\n "0040A170": {\n "vr": "SQ",\n

this is the part that i dont understand, i know that when i index my file to elasticsearch i should reach the indexed data form hits.hits.\_souce am i wrong about that end even if u'message' part contains some of the data it is partial and start from middle of it and contains a very little amount of the data

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2020, 8:26am UTC](https://discuss.elastic.co/t/how-to-get-all-the-source-from-json-that-indexed-with-logstash/222590/2 "2020-04-05T08:26:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.