# How to parse logs to nested json field then store in Elasticsearch?

**URL:** https://discuss.elastic.co/t/how-to-parse-logs-to-nested-json-field-then-store-in-elasticsearch/188477
**Category:** Logstash
**Created:** [July 2, 2019, 10:28am UTC](https://discuss.elastic.co/t/how-to-parse-logs-to-nested-json-field-then-store-in-elasticsearch/188477 "2019-07-02T10:28:51Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![LinJIngYun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/linjingyun/32/44151_2.png) [@LinJIngYun](https://discuss.elastic.co/u/LinJIngYun)
#### Post date: [July 2, 2019, 10:28am UTC](https://discuss.elastic.co/t/how-to-parse-logs-to-nested-json-field-then-store-in-elasticsearch/188477/1 "2019-07-02T10:28:51Z")

</div>

I want to parse AWS Elastic Loadbalancer Logs in to pattern that I can query for find the response time of each request does it fail or not, does request URI have fail from 404 or 500 ? or it it success from 200 somewhat like that.  
The pattern of logs from AWS ELB :

> client:port backend:port request\_processing\_time backend\_processing\_time response\_processing\_time elb\_status\_code backend\_status\_code received\_bytes sent\_bytes

For example I have log format like this

> 192.168.131.39:2817 10.0.0.1:80 0.000073 0.001048 0.000057 200 200 0 29

I want parse it to

```auto
{
    "client": {
        "request_client": {
            "full_url": "192.168.131.39:2817",
            "host": "192.168.131.39",
            "port": "2817",
            "status_code": 200,
            "received_byte": 0,
            "request_processing_time ": 0.000073
        },
        "backend":{
            "full_url": "10.0.0.1:80",
            "host": "10.0.0.1",
            "port": "80",
            "status_code": 200,
            "sent_byte": 29,
            "backend_processing_time": 0.001048,
            "response_processing_time": 0.000057
        }

    }
}

```

Thank you in advance or perhaps you can provide the tutorial link where I can read about it ? for now I have try Grok debugger it quite mess but it my first time thank you very much 🙂

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/7/b75a7b34dffec6aa170e8574d26165a9a4723096.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 30, 2019, 10:33am UTC](https://discuss.elastic.co/t/how-to-parse-logs-to-nested-json-field-then-store-in-elasticsearch/188477/2 "2019-07-30T10:33:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.