# How to parse and add filter in nested json

**URL:** <https://discuss.elastic.co/t/how-to-parse-and-add-filter-in-nested-json/179017>\
**Category:** Logstash\
**Created:** [April 30, 2019, 6:06am UTC](https://discuss.elastic.co/t/how-to-parse-and-add-filter-in-nested-json/179017 "2019-04-30T06:06:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![stour](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@stour](https://discuss.elastic.co/u/stour)\
**Post date:** [April 30, 2019, 6:06am UTC](https://discuss.elastic.co/t/how-to-parse-and-add-filter-in-nested-json/179017/1 "2019-04-30T06:06:23Z")

</div>

Hi,

I am trying to parse below json.

{  
"s\_no":1011,  
"uuid":"1f86c6ce84678e9bd5d67bcd49a86d3a99129d80",  
"data":{  
"time":"2019-01-01T13:32:10.8287355Z",  
"system":{  
"processors":[  
{  
"name":"Intel(R) Core(TM) i5-3570 CPU @ 3.40GHz",  
"cores":4,  
"logical\_processors":4  
}  
],  
"memory":"8457871360"  
},  
"os":{  
"product":"Windows 10 Pro x64",  
"build":9200  
}  
}  
}

For this Json how to add filter?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 30, 2019, 2:14pm UTC](https://discuss.elastic.co/t/how-to-parse-and-add-filter-in-nested-json/179017/2 "2019-04-30T14:14:06Z")

</div>

If you have an event that contains that in the message field you can parse it using

```
json { source => "message" }
```

---

<div class="post-metadata">

**Author:** ![stour](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@stour](https://discuss.elastic.co/u/stour)\
**Post date:** [May 2, 2019, 5:39am UTC](https://discuss.elastic.co/t/how-to-parse-and-add-filter-in-nested-json/179017/3 "2019-05-02T05:39:19Z")

</div>

Tried with following filter

**filter {**  
**json {**  
**source =\> "message"**  
**}**  
**}**

didn't get any error but index was not created.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2019, 5:39am UTC](https://discuss.elastic.co/t/how-to-parse-and-add-filter-in-nested-json/179017/4 "2019-05-30T05:39:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.