# How to parse a json message **URL:** \ **Category:** Logstash\ **Created:** [October 12, 2017, 6:02am UTC](https://discuss.elastic.co/t/how-to-parse-a-json-message/103652 "2017-10-12T06:02:30Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Navinder](https://avatars.discourse-cdn.com/v4/letter/n/a4c791/32.png) [@Navinder](https://discuss.elastic.co/u/Navinder)\ **Post date:** [October 12, 2017, 6:02am UTC](https://discuss.elastic.co/t/how-to-parse-a-json-message/103652/1 "2017-10-12T06:02:30Z")
I have the following input in grok. { "payload": { "user\_id": "323232323323223233", "order\_id": "4232313-32323232-232322323", "ts": "2017-09-01T00:59:00.0138639Z", "promo\_codes": [{ "amount": 10.0, }], "shipping\_contact\_name": "Person X", } } I want the output as mapping for each of the fields. I have used the filters below, but they are not working. filter { grok { match =\> { "message" =\> "%{WORD:MyWord} data=%{GREEDYDATA:payload}"} } json{ source =\> "request" target =\> "payload" remove\_field =\> ["request"] } mutate { add\_field =\> { "user\_id" =\> "%{[payload][user\_id]}" "order\_id" =\> "%{[payload][order\_id]}" "ts" =\> "%{[payload][ts]}" } } Can someone help? Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 12, 2017, 7:27am UTC](https://discuss.elastic.co/t/how-to-parse-a-json-message/103652/2 "2017-10-12T07:27:05Z")
This doesn't add up. The grok filter writes to the `payload` field and the json filter parses the `request` field and also writes to the `payload` field. ---
**Author:** ![zuokuok](https://avatars.discourse-cdn.com/v4/letter/z/c6cbf5/32.png) [@zuokuok](https://discuss.elastic.co/u/zuokuok)\ **Post date:** [October 12, 2017, 8:01am UTC](https://discuss.elastic.co/t/how-to-parse-a-json-message/103652/3 "2017-10-12T08:01:54Z")
@magnusbaeck Is the syntax correct for the json though? Can you access fields in this fashion after parsing to json (if in this case payload were the actual target)? And to add to this, if the json structure is always the same, but some field names might change, can you do it with an index search? For instance, in his example, if "order\_id" were a dynamic name, but always at the same place, how could you access this field? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 12, 2017, 8:32am UTC](https://discuss.elastic.co/t/how-to-parse-a-json-message/103652/4 "2017-10-12T08:32:46Z")
> Is the syntax correct for the json though? Yes. > Can you access fields in this fashion after parsing to json (if in this case payload were the actual target)? Yes. > For instance, in his example, if "order\_id" were a dynamic name, but always at the same place, how could you access this field? What does "at the same place" mean? Fields aren't positional so there's no way of saying "grab the value from the second field". If the name is dynamic, how would you know which field you're looking for? ---
**Author:** ![zuokuok](https://avatars.discourse-cdn.com/v4/letter/z/c6cbf5/32.png) [@zuokuok](https://discuss.elastic.co/u/zuokuok)\ **Post date:** [October 12, 2017, 9:26am UTC](https://discuss.elastic.co/t/how-to-parse-a-json-message/103652/5 "2017-10-12T09:26:48Z")
> What does "at the same place" mean? Fields aren't positional so there's no way of saying "grab the value from the second field". If the name is dynamic, how would you know which field you're looking for? I see what you mean, I think I'll need some string manipulation for that... Btw, do you access the fields like this in an "IF" statement? =\> if [jsonData][response][isSuccessful] == true or =\> if %{[jsonData][response][isSuccessful]} == true ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 12, 2017, 9:46am UTC](https://discuss.elastic.co/t/how-to-parse-a-json-message/103652/6 "2017-10-12T09:46:05Z")
The former. See [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html). ---
**Author:** ![zuokuok](https://avatars.discourse-cdn.com/v4/letter/z/c6cbf5/32.png) [@zuokuok](https://discuss.elastic.co/u/zuokuok)\ **Post date:** [October 12, 2017, 10:06am UTC](https://discuss.elastic.co/t/how-to-parse-a-json-message/103652/7 "2017-10-12T10:06:54Z")
Thanks. Sorry to insist, but consider this example: "response": { "isSuccessful": true, "ThisFieldIsDynamic": { "Header": { "ID": "something" } } } Is there a way to access "Header" without knowing the name of "ThisFieldIsDynamic"? I cannot find examples that work... and a clean json (using ruby?) solution would be awesome! Something like [response]["regex?"][Header] ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 12, 2017, 11:02am UTC](https://discuss.elastic.co/t/how-to-parse-a-json-message/103652/8 "2017-10-12T11:02:03Z")
You'll have to write a piece of Ruby in a ruby filter that iterates over the values of the `response` hash and checks what type each value is. If it's a hash then look for the `Header` subfield in that hash. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 9, 2017, 11:02am UTC](https://discuss.elastic.co/t/how-to-parse-a-json-message/103652/9 "2017-11-09T11:02:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.