# How to parse API HTTP output data

**URL:** <https://discuss.elastic.co/t/how-to-parse-api-http-output-data/330829>\
**Category:** Logstash\
**Created:** [April 26, 2023, 11:29am UTC](https://discuss.elastic.co/t/how-to-parse-api-http-output-data/330829 "2023-04-26T11:29:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sonirajil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sonirajil/32/99235_2.png) [@sonirajil](https://discuss.elastic.co/u/sonirajil)\
**Post date:** [April 26, 2023, 11:29am UTC](https://discuss.elastic.co/t/how-to-parse-api-http-output-data/330829/1 "2023-04-26T11:29:38Z")

</div>

Hello Team,  
I am running an API to get servicestatus data which looks like :

```auto
{
    "recordcount": 11906,
    "servicestatus": [
        {
            "host_name": "unixteam.abc.com",
            "service_description": "Disk Usage on \/var\/opt\/ansible",
            "display_name": "Disk Usage on \/var\/opt\/ansible",
            "host_object_id": "6512",
            "host_address": "123.45.67.202",
            "host_alias": "unixteam.abc.com",
            "icon_image": "",
            "icon_image_alt": "",
            "notes": "",
            "notes_url": "",
            "action_url": "",
            "servicestatus_id": "21119",
            "instance_id": "1",
            "service_object_id": "10616",
            "status_update_time": "2023-04-25 10:06:46",
            "output": "OK: Used_percent was 0.00 %",
            "long_output": "",
            "perfdata": "'used_percent'=0.00%;90;95;",
            "last_check": "2023-04-25 09:57:23",
            "next_check": "2023-04-25 10:07:22",
            "check_type": "0",
            "check_options": "0",
            "last_state_change": "2022-10-31 04:36:40",
            "last_hard_state_change": "2022-10-31 04:36:40",
            "last_hard_state": "0",
            "last_time_ok": "2023-04-25 09:57:23",
            "last_time_warning": "1969-12-31 19:00:00",
            "last_time_unknown": "2022-10-27 18:22:17",
            "last_time_critical": "2022-10-27 17:31:04",
            "state_type": "1",
            "last_notification": "1969-12-31 19:00:00",
            "next_notification": "1969-12-31 19:00:00",
            "no_more_notifications": "0",
            "notifications_enabled": "1",
            "problem_has_been_acknowledged": "0",
            "percent_state_change": "0",
            "check_command": "check_xi_ncpa!-t 'mytoken' -P 5693 -M 'disk\/logical\/|var|opt|ansible\/used_percent' -w 90 -c 95",
            "normal_check_interval": "10",
            "retry_check_interval": "2",
            "check_timeperiod_object_id": "145"
        } ]
}

```

I tried to use mutate filter in my code as explained in existing topics in forum as below :

```auto

input {

file {
    path => "/home/evs16/test.json"
    start_position => beginning
    sincedb_path => "/dev/null"
  }

filter {
    json {
#rs source => "servicestatus"
    source => "message"
         }
   mutate {
    add_field => { "hostname" => "{%[servicestatus][host_name]}"
                   "service_description" => "{%[servicestatus][service_description]}"
#rs "check_command" => "%{[check_command]}"
                  }
      }
}
output {
        stdout { codec => rubydebug }
   
}

```

But I am not getting expected field as output but something like below as output

```auto

           "@timestamp" => 2023-04-26T11:19:06.940Z,
               "@version" => "1",
    "service_description" => "{%[servicestatus][service_description]}",
                   "path" => "/home/evs16/test.json",
                   "host" => "gvabc01q",
               "hostname" => "{%[servicestatus][host_name]}",
                "message" => " \"service_description\": \"Disk Usage on \\/var\\/opt\\/ansible\","

```

Please help , I simply wants to extract few fields from above api output or If any similar post we already must be having that would help

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 26, 2023, 12:00pm UTC](https://discuss.elastic.co/t/how-to-parse-api-http-output-data/330829/2 "2023-04-26T12:00:00Z")

</div>

Is the return of your API in the file `/home/evs16/test.json` a single line json or you have it pretty printed like you shared?

Logstas reads the file line by line, each line is an document/event, so your return event from the API needs to be in a single line or you will need to use the `multiline codec`.

---

<div class="post-metadata">

**Author:** ![sonirajil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sonirajil/32/99235_2.png) [@sonirajil](https://discuss.elastic.co/u/sonirajil)\
**Post date:** [April 27, 2023, 9:00am UTC](https://discuss.elastic.co/t/how-to-parse-api-http-output-data/330829/3 "2023-04-27T09:00:03Z")

</div>

Actually, for testing purpose I had put data in file input as actual API has a huge output. I will try mutliline codec as advised and come back if any further issue I face.  
Thanks Leandro.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2023, 9:00am UTC](https://discuss.elastic.co/t/how-to-parse-api-http-output-data/330829/4 "2023-05-25T09:00:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.