# How to split array json into multiple fields

**URL:** <https://discuss.elastic.co/t/how-to-split-array-json-into-multiple-fields/267112>\
**Category:** Logstash\
**Created:** [March 12, 2021, 4:52pm UTC](https://discuss.elastic.co/t/how-to-split-array-json-into-multiple-fields/267112 "2021-03-12T16:52:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![prabhakar\_talari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prabhakar_talari/32/46469_2.png) [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\
**Post date:** [March 12, 2021, 4:52pm UTC](https://discuss.elastic.co/t/how-to-split-array-json-into-multiple-fields/267112/1 "2021-03-12T16:52:37Z")

</div>

Hi All,

I have a array json which am getting from http end point

`"summary": { "result": [{ "status": { "offlineCount": 0, "warningCount": 0, "onlineCount": 1 }, "store": { "code": "345", "name": "Groovy", "id": "8" } }, { "status": { "offlineCount": 1, "warningCount": 0, "onlineCount": 0 }, "store": { "code": "3435", "name": "Groovy Result", "id": "8" } }] }`

I need to split into multiple documents like below

```
"summary": {
  "result": [
    {
      "status": {
        "offlineCount": 0,
        "warningCount": 0,
        "onlineCount": 1
      },
      "store": {
        "code": "345",
        "name": "Groovy",
        "id": "8"
      }
    }
	]
}

```

"summary": {   
"result": [  
{  
"status": {  
"offlineCount": 1,  
"warningCount": 0,  
"onlineCount": 0  
},  
"store": {  
"code": "3435",  
"name": "Groovy Result",  
"id": "8"  
}  
}  
]  
}

Could some one help me how can achieve this using logstash/ingestion pipelines

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 12, 2021, 6:57pm UTC](https://discuss.elastic.co/t/how-to-split-array-json-into-multiple-fields/267112/2 "2021-03-12T18:57:58Z")

</div>

Use a split filter

```
 split { field => "[summary][result]" }
```

---

<div class="post-metadata">

**Author:** ![prabhakar\_talari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prabhakar_talari/32/46469_2.png) [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\
**Post date:** [March 13, 2021, 8:33am UTC](https://discuss.elastic.co/t/how-to-split-array-json-into-multiple-fields/267112/3 "2021-03-13T08:33:59Z")

</div>

> [@Badger](#):
>
> `[summary][result]`

Thank you for the response. I am getting below error in logstash

[2021-03-13T08:33:15,282][WARN][logstash.filters.split] Only String and Array types are splittable. field:[summary][result] is of type = NilClass

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 13, 2021, 2:39pm UTC](https://discuss.elastic.co/t/how-to-split-array-json-into-multiple-fields/267112/4 "2021-03-13T14:39:27Z")

</div>

That is telling you that the [summary][result] field does not exist. You could avoid logging that by using

```
if [summary][result] { split { field => "[summary][result]" } }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2021, 2:39pm UTC](https://discuss.elastic.co/t/how-to-split-array-json-into-multiple-fields/267112/5 "2021-04-10T14:39:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.