# How to shange JSON Output so its not wrapped in a field name

**URL:** <https://discuss.elastic.co/t/how-to-shange-json-output-so-its-not-wrapped-in-a-field-name/366738>\
**Category:** Logstash\
**Created:** [September 18, 2024, 12:48pm UTC](https://discuss.elastic.co/t/how-to-shange-json-output-so-its-not-wrapped-in-a-field-name/366738 "2024-09-18T12:48:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wilks](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Wilks](https://discuss.elastic.co/u/Wilks)\
**Post date:** [September 18, 2024, 12:48pm UTC](https://discuss.elastic.co/t/how-to-shange-json-output-so-its-not-wrapped-in-a-field-name/366738/1 "2024-09-18T12:48:09Z")

</div>

How to I output my JSON so that it looks like this

```auto
[{"value":"main.abc.com","risk":"High","type":"fqdn","notes":"suspect"}]

```

Its currently outputting like this

```auto
{"domain_data":[{"value":"main.abc.com","risk":"High","type":"fqdn","notes":"suspect"}]}

```

So I need to drop the "domain\_data" field.

My filter is currently as follows:

```auto
input {
  http_poller {
    urls => {
      domain_data => {
        method => "get"
        url => "https://api.test.com/api/v2/test/"
        headers => {
                  "authorization" => "apikey <api_user>:<api_key>"
          Accept => "application/json"
        }
      }
    }
    truststore => "/home/test/ca.test.com.jks"
    truststore_password => "<truststore-password>"
    request_timeout => 60
    schedule => { cron => "* * * * * UTC" }
    codec => "json"
  }
}

filter {
  ruby {
    code => "
      domain_list = []

      # Get the 'objects' array from the event
      objects = event.get('objects')
      if objects
        # Iterate through each object in the 'objects' array
        objects.each do |object|
          value = object['value']

          if value
            # Initialize a hash to store data for each entry
            entry_info = {
              'value' => value,
              'notes' => 'suspect',
              'type' => 'fqdn'
            }

            # Assign risk (threat level) based on the 'threatscore'
            threatscore = object['threatscore']
            if threatscore
              case threatscore
              when 1..50
                entry_info['risk'] = 'Low'
              when 51..70
                entry_info['risk'] = 'Medium'
              when 71..85
                entry_info['risk'] = 'High'
              when 86..100
                entry_info['risk'] = 'Critical'
              else
                entry_info['risk'] = 'unknown'
              end
            end

            # Add the info hash to the list
            domain_list << entry_info
          end
        end
      end

      # Remove duplicates based on 'value'
      domain_list.uniq! { |item| item['value'] }

      # Set the extracted values to 'mal_url_data' in the event
      event.set('domain_data', domain_list)
    "
  }

mutate {
               remove_field => ["objects"]
               remove_field => ["@version"]
               remove_field => ["@timestamp"]
               remove_field => ["meta"]
       }

}

output {
  stdout {
    codec => rubydebug
  }

file {
codec => "json"
path => ["/usr/share/logstash/bin/domain.json"]
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 18, 2024, 1:34pm UTC](https://discuss.elastic.co/t/how-to-shange-json-output-so-its-not-wrapped-in-a-field-name/366738/2 "2024-09-18T13:34:35Z")

</div>

> [@Wilks](#):
>
> `event.set('domain_data', domain_list)`

Replace this with `event.set('domain_data', domain_list.to_json)` and then replace `codec => "json"` with `codec => line { format => "%{domain_data}" }`

---

<div class="post-metadata">

**Author:** ![Wilks](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Wilks](https://discuss.elastic.co/u/Wilks)\
**Post date:** [September 18, 2024, 2:22pm UTC](https://discuss.elastic.co/t/how-to-shange-json-output-so-its-not-wrapped-in-a-field-name/366738/3 "2024-09-18T14:22:58Z")

</div>

Perfect!!! Thanks