# How to refer to an object's sub field in a filter

**URL:** https://discuss.elastic.co/t/how-to-refer-to-an-objects-sub-field-in-a-filter/144809
**Category:** Logstash
**Created:** [August 17, 2018, 2:59am UTC](https://discuss.elastic.co/t/how-to-refer-to-an-objects-sub-field-in-a-filter/144809 "2018-08-17T02:59:44Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Jing\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jing_wang/32/34618_2.png) [@Jing\_Wang](https://discuss.elastic.co/u/Jing_Wang)
#### Post date: [August 17, 2018, 2:59am UTC](https://discuss.elastic.co/t/how-to-refer-to-an-objects-sub-field-in-a-filter/144809/1 "2018-08-17T02:59:45Z")

</div>

I have 3 datetime string fileds, and i want to parse them by date filter and make the last one as the @timestamp of the doc

```
date {
      match => ["syslog.timestamp", "MMM dd HH:mm:ss"]
      target => "syslog.timestamp"
}
date {
      match => ["skyeye.timestamp", "yyyy-MM-dd HH:mm:ss"]
      target => "skyeye.timestamp"
}
date {
      match => ["[skyeye][access_time]", "ISO8601"]
}

```

both syslog and skyeye are top level obejct field and this configuration works correctly.

here is my problem  
if i refer to the former two filed with '[][]' format

```
date {
    match => ["[skyeye][timestamp]", "yyyy-MM-dd HH:mm:ss"]
    target => "skyeye.timestamp"
}

```

i will get an error message in dlq:

#`<LogStash::Event:0x247e42b8>], response: {"index"=>{"_index"=>"syslog-000001", "_type"=>"doc", "_id"=>"6X23RWUBVU5Xq3uPB_7M", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [skyeye.timestamp]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"2018-08-17 10:29:08\" is malformed at \" 10:29:08\""}}`

but if i refer to the last filed using '.' fromat

```
date {
      match => ["skyeye.access_time", "ISO8601"]
}

```

the @timestamp is no set properly

i am very confused  
please help

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 20, 2018, 7:09pm UTC](https://discuss.elastic.co/t/how-to-refer-to-an-objects-sub-field-in-a-filter/144809/2 "2018-08-20T19:09:12Z")

</div>

Please show an example document as produced by Logstash. You can copy/paste from Kibana's JSON tab.

---

<div class="post-metadata">

### Author: ![Jing\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jing_wang/32/34618_2.png) [@Jing\_Wang](https://discuss.elastic.co/u/Jing_Wang)
#### Post date: [August 24, 2018, 1:36am UTC](https://discuss.elastic.co/t/how-to-refer-to-an-objects-sub-field-in-a-filter/144809/3 "2018-08-24T01:36:18Z")

</div>

Thanks.  
I've got the point.

The es accepts both json object fileds and fileds with `.` in their names. Both two kind of fileds are considered as objects.  
There are two kind of josn data in my index with the same mapping.

when i use `.` names in logstash filters  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/9/893e2227637ba33bf9369bfd583e1e7338a9cdab.png)  
In this case, I cannot refer to the filed with `[][]` format

when i use `[][]` names in logstash filters.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/d/edd67432e6623b220a873ac18c3ef2d3fad12b76.png)  
In this case, I cannot refer to the filed with `.` format

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 21, 2018, 1:36am UTC](https://discuss.elastic.co/t/how-to-refer-to-an-objects-sub-field-in-a-filter/144809/4 "2018-09-21T01:36:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.