# How to loop through json arrays and apply filter

**URL:** <https://discuss.elastic.co/t/how-to-loop-through-json-arrays-and-apply-filter/48558>\
**Category:** Logstash\
**Created:** [April 27, 2016, 1:26pm UTC](https://discuss.elastic.co/t/how-to-loop-through-json-arrays-and-apply-filter/48558 "2016-04-27T13:26:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![abhuyan](https://avatars.discourse-cdn.com/v4/letter/a/e56c9b/32.png) [@abhuyan](https://discuss.elastic.co/u/abhuyan)\
**Post date:** [April 27, 2016, 1:26pm UTC](https://discuss.elastic.co/t/how-to-loop-through-json-arrays-and-apply-filter/48558/1 "2016-04-27T13:26:21Z")

</div>

My JSON log looks like this:  
{  
"ns\_records": [{  
"nsip": "208.84.0.53",  
"nsname": "[ns1.msft.net](http://ns1.msft.net)"  
}, {  
"nsip": "208.84.2.53",  
"nsname": "[ns2.msft.net](http://ns2.msft.net)"  
}],  
"domain": "[mx1.hotmail.com](http://mx1.hotmail.com)",  
"country\_iso": "US",  
"ip": "65.54.188.72"  
}

Wanted to add geo information for both 'ip' as well as nsip's. How do I loop through all nsip's and add geoip within ns\_records? If I manually give array index it works but number of elements within ns\_records is variable. My logstatsh config:

```
input { stdin { codec => "json" } }
filter {
  mutate {
    remove_field => ["@timestamp", "@version", "host", "tags"]
  }

    if [ip] {
    geoip {
      source => "ip"
      target => "geoip"
      database => "/etc/logstash/GeoLiteCity.dat"
      fields => ["country_code3","city_name", "postal_code","real_region_name", "latitude", "longitude", "location"]
    }
  }

   if [ns_records][nsip] {
     geoip {
        source => "[ns_records][0][nsip]"
        target => "[ns_records][0][nsgeoip]"
        database => "/etc/logstash/GeoLiteCity.dat"
        fields => ["country_code3","city_name", "postal_code","real_region_name", "latitude", "longitude", "location"]
   }
  }
}

output { stdout { codec => "rubydebug" } }

```

The response looks like this:

```
{
     "ns_records" => [
        [0] {
               "nsip" => "208.84.0.53",
             "nsname" => "ns1.msft.net",
            "nsgeoip" => {
                   "country_code3" => "USA",
                       "city_name" => "Redmond",
                     "postal_code" => "98052",
                        "latitude" => 47.68010000000001,
                       "longitude" => -122.1206,
                "real_region_name" => "Washington",
                        "location" => [
                    [0] -122.1206,
                    [1] 47.68010000000001
                ]
            }
        },
        [1] {
              "nsip" => "208.84.2.53",
            "nsname" => "ns2.msft.net"
    ],
         "domain" => "mx1.hotmail.com",
             "ip" => "65.54.188.72",
    "country_iso" => "US",
          "geoip" => {
           "country_code3" => "USA",
               "city_name" => "San Jose",
             "postal_code" => "95103",
                "latitude" => 37.33940000000001,
               "longitude" => -121.89500000000001,
			"real_region_name" => "California",
                "location" => [
            [0] -121.89500000000001,
            [1] 37.33940000000001
        ]
    }
}
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 30, 2016, 3:13pm UTC](https://discuss.elastic.co/t/how-to-loop-through-json-arrays-and-apply-filter/48558/2 "2016-04-30T15:13:08Z")

</div>

This isn't possible right now. The geoip filter accepts an array field as the source field but only the first element of that array will be processed.

---

<div class="post-metadata">

**Author:** ![abhuyan](https://avatars.discourse-cdn.com/v4/letter/a/e56c9b/32.png) [@abhuyan](https://discuss.elastic.co/u/abhuyan)\
**Post date:** [May 2, 2016, 8:02am UTC](https://discuss.elastic.co/t/how-to-loop-through-json-arrays-and-apply-filter/48558/3 "2016-05-02T08:02:44Z")

</div>

So having multiple conditions `if [ns_records][nsip][0] {} , if [ns_records][nsip][1] {}` .... statically would be the only way?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 3, 2016, 6:42pm UTC](https://discuss.elastic.co/t/how-to-loop-through-json-arrays-and-apply-filter/48558/4 "2016-05-03T18:42:19Z")

</div>

Yes. You could of course generate such a configuration file so you won't have to copy/paste so much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/how-to-loop-through-json-arrays-and-apply-filter/48558/5 "2017-07-06T04:59:30Z")

</div>