# How to parse JSON with nested field name "source"

**URL:** <https://discuss.elastic.co/t/how-to-parse-json-with-nested-field-name-source/50083>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 15, 2016, 6:48pm UTC](https://discuss.elastic.co/t/how-to-parse-json-with-nested-field-name-source/50083 "2016-05-15T18:48:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![a\_acev](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@a\_acev](https://discuss.elastic.co/u/a_acev)\
**Post date:** [May 15, 2016, 6:48pm UTC](https://discuss.elastic.co/t/how-to-parse-json-with-nested-field-name-source/50083/1 "2016-05-15T18:48:02Z")

</div>

Hi, I am new to ELK. I am trying to parse JSON strings that contain field name "source".  
Here is an example:  
{"feed": {"name": "AlienVault", "accuracy": 100.0, "url": "[https://reputation.alienvault.com/reputation.data](https://reputation.alienvault.com/reputation.data)"}, "classification": {"type": "spam"}, "time": {"observation": "2016-05-15T16:57:03+00:00"}, "source": {"geolocation": {"latitude": 51.5332984924, "longitude": 0.699999988079, "cc": "GB", "city": "Southend"}, "ip": "163.172.198.227"}, "raw": "MTYzLjE3Mi4xOTguMjI3IzYjMiNTcGFtbWluZyNHQiNTb3V0aGVuZCM1MS41MzMyOTg0OTI0LDAuNjk5OTk5OTg4MDc5IzEy"}

In ElasticSearch /Kibana I have a field named "source" but it contains the path to the txt file where logs are stored. The output is:

"\_source": {  
"raw": "MjIyLjEzNi43MS4xOSMzIzIjU2Nhbm5pbmcgSG9zdCNDTiNaaGVuZ3pob3UjMzQuNjgzNjAxMzc5NCwxMTMuNTMyNTAxMjIxIzEx",  
"source": "/opt/intelmq/var/lib/bots/file-output/events.txt",  
"classification": {  
"type": "scanner"  
}

Somehow in ES I am missing these fields and their values:

```
    "geolocation": {
        "latitude": 51.5332984924,
        "longitude": 0.699999988079,
        "cc": "GB",
        "city": "Southend"
    },
    "ip": "163.172.198.227"

```

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 17, 2016, 2:41pm UTC](https://discuss.elastic.co/t/how-to-parse-json-with-nested-field-name-source/50083/2 "2016-05-17T14:41:25Z")

</div>

How are you inserting the data into ES?

---

<div class="post-metadata">

**Author:** ![a\_acev](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@a\_acev](https://discuss.elastic.co/u/a_acev)\
**Post date:** [May 17, 2016, 7:39pm UTC](https://discuss.elastic.co/t/how-to-parse-json-with-nested-field-name-source/50083/3 "2016-05-17T19:39:25Z")

</div>

Hi Mark,  
I use filebeat to send the data to logstash and from there to ES.  
Is it possible that filebeat is modifying the data before it reaches Logstash, because the value for the "source" field is the configuration setting in filebeat.yml file for filebeat -\> prospectors-\>paths.  
If this is the case is there a way to stop filebeat from modifying the input to logstash?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:51pm UTC](https://discuss.elastic.co/t/how-to-parse-json-with-nested-field-name-source/50083/4 "2017-07-05T21:51:49Z")

</div>