# How to parse nested json through logstash **URL:** \ **Category:** Logstash\ **Created:** [June 16, 2020, 12:08pm UTC](https://discuss.elastic.co/t/how-to-parse-nested-json-through-logstash/237290 "2020-06-16T12:08:59Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Rahul\_rr](https://avatars.discourse-cdn.com/v4/letter/r/ce7236/32.png) [@Rahul\_rr](https://discuss.elastic.co/u/Rahul_rr)\ **Post date:** [June 16, 2020, 12:08pm UTC](https://discuss.elastic.co/t/how-to-parse-nested-json-through-logstash/237290/1 "2020-06-16T12:08:59Z")
I'm getting the data from sqs queue as a nested json and parsing through logstash. i tried some approaches but it didn't work. Below is my sample nested json. { "service\_event": { "id": 166175, "equipment": { "id": 166175, "equipment\_number": "CRTE123456", "equipment\_type": "Tractor", "associated\_container\_number": null, "associated\_tractor\_number": "CRTE123456", "associated\_trailer\_number": null }, "event\_code": "AA165585", "source": "web", "td": { "id": 304, "name": "Crete Carrier" }, "ep": { "id": 9, "name": "NACPC" Here is my logstash conf file: filter { json { source =\> "Message" target =\> "parsed" } mutate { add\_field =\> { ``` "service_id" => "%{[parsed][service_event][id]}" "equipment_id" => "%{[parsed][service_event][equipment][id]}" "equipment_number" => "%{[parsed][service_event][equipment][equipment_number]}" "equipment_type" => "%{[parsed][service_event][equipment][equipment_type]}" } ``` This is what i'm getting in ruby debug output: "equipment\_type" =\> "%{[parsed][service\_event][0][equipment][equipment\_type]}", "equipment\_number" =\> "%{[parsed][service\_event][0][equipment][equipment\_number]}" } What am i doing wrong. Any help is appreciated. Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 16, 2020, 3:20pm UTC](https://discuss.elastic.co/t/how-to-parse-nested-json-through-logstash/237290/2 "2020-06-16T15:20:39Z")
service\_event does not appear to be an array, so remove the [0] ---
**Author:** ![Rahul\_rr](https://avatars.discourse-cdn.com/v4/letter/r/ce7236/32.png) [@Rahul\_rr](https://discuss.elastic.co/u/Rahul_rr)\ **Post date:** [June 17, 2020, 6:38am UTC](https://discuss.elastic.co/t/how-to-parse-nested-json-through-logstash/237290/4 "2020-06-17T06:38:40Z")
I removed the target =\> parsed from my json filter and it is working fine now. But i'm getting another error because of my timestamp fields. Because some of my timestamp fields are null for some events (for eg: when my event gets created i will get value in "open\_time" field and my "completed\_time" gets null value until the events gets completed). So, in this case how to resolve? any suggestions. Thanks. ---
**Author:** ![Rahul\_rr](https://avatars.discourse-cdn.com/v4/letter/r/ce7236/32.png) [@Rahul\_rr](https://discuss.elastic.co/u/Rahul_rr)\ **Post date:** [June 18, 2020, 12:20pm UTC](https://discuss.elastic.co/t/how-to-parse-nested-json-through-logstash/237290/5 "2020-06-18T12:20:14Z")
Some of my fields are null values in the nested json. So, when I parse the nested json through logstash, it is not getting parsed. ![ss](https://us1.discourse-cdn.com/elastic/original/3X/b/e/be36114dad69956c030fc30609fa6587ecbec4ba.png) Pls look at my output image and tell me some suggestions. Thanks ---
**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\ **Post date:** [June 18, 2020, 12:25pm UTC](https://discuss.elastic.co/t/how-to-parse-nested-json-through-logstash/237290/6 "2020-06-18T12:25:16Z")
you will have to use conditionals to check for not null before applying mutations. add\_field will add arbitrary values, so if the value is null, it will add the reference to the value ---
**Author:** ![Rahul\_rr](https://avatars.discourse-cdn.com/v4/letter/r/ce7236/32.png) [@Rahul\_rr](https://discuss.elastic.co/u/Rahul_rr)\ **Post date:** [June 18, 2020, 12:28pm UTC](https://discuss.elastic.co/t/how-to-parse-nested-json-through-logstash/237290/7 "2020-06-18T12:28:45Z")
I tried some ruby filters but none of them is working. Can you please post some examples, so that I can understand clearly. Thanks ---
**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\ **Post date:** [June 18, 2020, 12:36pm UTC](https://discuss.elastic.co/t/how-to-parse-nested-json-through-logstash/237290/8 "2020-06-18T12:36:37Z")
for example ``` if [service_event][equipment][id] { mutate { add_field => { “[equipment_id] => “%{[service_event][equipment][id]} } } } ``` will only assign the value of [service\_event][equipment][id] to [equipment\_id] if the value is not null. ---
**Author:** ![Rahul\_rr](https://avatars.discourse-cdn.com/v4/letter/r/ce7236/32.png) [@Rahul\_rr](https://discuss.elastic.co/u/Rahul_rr)\ **Post date:** [June 18, 2020, 2:55pm UTC](https://discuss.elastic.co/t/how-to-parse-nested-json-through-logstash/237290/9 "2020-06-18T14:55:39Z")
Thanks @ptamba. I have one more query on array type json. In my case i'm getting the array json dynamically. for eg.., 1st event==\>"service\_lines" =\> [ [0] { "aar" =\> { "category" =\> { "id" =\> 42, "name" =\> "Tires" }, "system" =\> { "id" =\> 1, "name" =\> "Tire" }, "subsystem" =\> { "id" =\> 1, "name" =\> "Tire" }, "service" =\> { "id" =\> 53, "name" =\> "Service Call - Tire" } }, "id" =\> 586131, "is\_approved" =\> nil, "vmrs" =\> nil }, For one event i will get one array and for another i may get 2 or 3 arrays. So, in that case how to parse my json. Any suggestions. Thanks for your help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 16, 2020, 2:55pm UTC](https://discuss.elastic.co/t/how-to-parse-nested-json-through-logstash/237290/10 "2020-07-16T14:55:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.