# How to parse array\[\] in json

**URL:** <https://discuss.elastic.co/t/how-to-parse-array-in-json/225998>\
**Category:** Logstash\
**Created:** [April 1, 2020, 7:44am UTC](https://discuss.elastic.co/t/how-to-parse-array-in-json/225998 "2020-04-01T07:44:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![spc1jh](https://avatars.discourse-cdn.com/v4/letter/s/a88e57/32.png) [@spc1jh](https://discuss.elastic.co/u/spc1jh)\
**Post date:** [April 1, 2020, 7:44am UTC](https://discuss.elastic.co/t/how-to-parse-array-in-json/225998/1 "2020-04-01T07:44:14Z")

</div>

Hi all,

I want to monitir aws waf2 logs with elastic search.

I tried to insert data in elasticsearch with logstash.  
I faced some problems.

shortly below is the json format data

```auto
{
  "nonTerminatingMatchingRules" : [
	{
	  "ruleId" : "AWS-AWSManagedRulesCommonRuleSet",
	  "action" : "COUNT"
	}
  ],
  "ruleGroupList" : [
	{
	  "excludedRules" : null,
	  "nonTerminatingMatchingRules" : [],
	  "ruleGroupId" : "arn:aws:wafv2:xxxx:xxxx:regional/rulegroup/HTTP_Header_Injection/xxxxx",
	  "terminatingRule" : null
	},
	{
	  "excludedRules" : null,
	  "nonTerminatingMatchingRules" : [],
	  "ruleGroupId" : "AWS#AWSManagedRulesCommonRuleSet",
	  "terminatingRule" : {
		"ruleId" : "SizeRestrictions_BODY",
		"action" : "BLOCK"
	  }
	}
  ],         
  "action" : "ALLOW",
}

```

I really want to parsing ruleGroupList area.

If I use split filter in logstash, only one data is remained as below.

```auto
filter {
  split { field => "[ruleGroupList]" }
}

```

==\>

```auto
ruleGroupList" : {
            "ruleGroupId" : "AWS#AWSManagedRulesCommonRuleSet",
            "nonTerminatingMatchingRules" : [],
            "terminatingRule" : {
              "action" : "BLOCK",
              "ruleId" : "SizeRestrictions_BODY"
            },
            "excludedRules" : null
          },

```

only one data is remaind, even if two data was exist originally.  
How to parse correctly, please let me know.

Thanks.

---

<div class="post-metadata">

**Author:** ![Rahul\_Kumar4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_kumar4/32/67369_2.png) [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)\
**Post date:** [April 1, 2020, 12:32pm UTC](https://discuss.elastic.co/t/how-to-parse-array-in-json/225998/2 "2020-04-01T12:32:50Z")

</div>

@spc1jh

Try using the `json` filter before passing it through the `split` filter.

```
filter {
  
  json{
    source => "message"
  }

  split { field => "[ruleGroupList]" }
}

```

Also your raw log has that trailing `,` after the `action` field which makes it an invalid JSON, so you may want to fix that before giving this a try.

---

<div class="post-metadata">

**Author:** ![spc1jh](https://avatars.discourse-cdn.com/v4/letter/s/a88e57/32.png) [@spc1jh](https://discuss.elastic.co/u/spc1jh)\
**Post date:** [April 2, 2020, 7:39am UTC](https://discuss.elastic.co/t/how-to-parse-array-in-json/225998/3 "2020-04-02T07:39:08Z")

</div>

Thanks,  
but I already used json filter.  
here is the filter rules that I am using.

```auto
    json {
       source => "message"
     }

     geoip {
       source => "[httpRequest][clientIp]"
       target => "geoip"
       add_tag => ["waf-geoip"]
     }

     split {
       field => "[ruleGroupList]"
     }

     date {
         match => ["timestamp", "UNIX_MS"]
         target => "timestamp"
     }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 30, 2020, 7:39am UTC](https://discuss.elastic.co/t/how-to-parse-array-in-json/225998/4 "2020-04-30T07:39:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.