# How to parse the json field with grok

**URL:** https://discuss.elastic.co/t/how-to-parse-the-json-field-with-grok/155103
**Category:** Logstash
**Created:** [November 2, 2018, 2:47am UTC](https://discuss.elastic.co/t/how-to-parse-the-json-field-with-grok/155103 "2018-11-02T02:47:18Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![talon](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@talon](https://discuss.elastic.co/u/talon)
#### Post date: [November 2, 2018, 2:47am UTC](https://discuss.elastic.co/t/how-to-parse-the-json-field-with-grok/155103/1 "2018-11-02T02:47:18Z")

</div>

HI here is my message

> {"@timestamp":"2018-11-01T03:05:28.391Z","records":[{"properties":{"Keywords":0,"Message":"w3wp.exe Information: 0 :\r\n| 2018-10-31 02:43:16.396 | AuthorizeActivityAttributeBase:IsAuthorizedAsync | Line:63 | ActivityId:491b7b3e-61bc-490e-bcc0-286338e41727 | --\> Entry","RoleName":"CloudPlatform.Tenant.Web","TraceEventId":0,"TraceMessage":"| 2018-10-31 02:43:16.396 | AuthorizeActivityAttributeBase:IsAuthorizedAsync | Line:63 | ActivityId:491b7b3e-61bc-490e-bcc0-286338e41727 | --\> Entry","TraceSource":"w3wp.exe","RoleInstanceId":"CloudPlatform.Tenant.Web\_IN\_0","TraceEventType":8,"ProviderName":"SerilogInput","SourceContext":"SerilogTraceListener.SerilogTraceListener"},"level":"Informational","time":"2018-10-31T02:43:16.3968015+00:00"}],"@version":"1"}

now i want to grok records.properties.Message and get value of ActivityId

Here is my configuration in logstash

> filter  
> {  
> grok  
> {  
> break\_on\_match =\> false  
> match =\> [  
> "[records][properties][Message]", "SystemGuid:(?.{37})",  
> "[records][properties][Message]", "ActivityId:(?.{37})"  
> ]  
> }  
> }  
> }

but it doesn't work ,can you give me some advice  
thank you

---

<div class="post-metadata">

### Author: ![Petr.Simik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petr.simik/32/38082_2.png) [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)
#### Post date: [November 2, 2018, 5:17am UTC](https://discuss.elastic.co/t/how-to-parse-the-json-field-with-grok/155103/2 "2018-11-02T05:17:27Z")

</div>

I do similar staff with json + mutate filter

1. 

```
#create parsed_json from input message

```

> ```
> json {
> source => "message"
> target => "parsed_json"
> }
> 
> ```

1. #extract from parsed json important fields

> mutate {
> 
> ```
> add_field => {"timestamp" => "%{[parsed_json][timestamp]}"}
> add_field => {"message" => "%{[parsed_json][properties][Message]}"}
> add_field => {"ActivityId" => "%{[parsed_json][properties][ActivityId]}"}
>   
> remove_field => ["json", "message"]
> remove_field => ["json", "parsed_json"]
> }
> 
> ```

later you can parse ActivityId further if you like

> match =\> { "ActivityId" =\> "(?(.{36}?))" }  
> or  
> match =\>{ "ActivityId" =\> "(?(.\*)) |" }

---

<div class="post-metadata">

### Author: ![talon](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@talon](https://discuss.elastic.co/u/talon)
#### Post date: [November 2, 2018, 7:04am UTC](https://discuss.elastic.co/t/how-to-parse-the-json-field-with-grok/155103/3 "2018-11-02T07:04:45Z")

</div>

Hi  
thanks for your response  
here is my configuration and it work now.  
filter  
{  
json{ source =\> "message" }  
split{ field =\> "records" }  
grok  
{  
break\_on\_match =\> false  
match =\> [  
"[records][properties][Message]", "SystemGuid:(?.{37})",  
"[records][properties][Message]", "ActivityId:(?.{37})"  
]  
}  
}

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 30, 2018, 7:04am UTC](https://discuss.elastic.co/t/how-to-parse-the-json-field-with-grok/155103/4 "2018-11-30T07:04:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.