# How to transform a json object into flat fields in watcher?

**URL:** <https://discuss.elastic.co/t/how-to-transform-a-json-object-into-flat-fields-in-watcher/250044>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [September 26, 2020, 7:35am UTC](https://discuss.elastic.co/t/how-to-transform-a-json-object-into-flat-fields-in-watcher/250044 "2020-09-26T07:35:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\
**Post date:** [September 26, 2020, 7:35am UTC](https://discuss.elastic.co/t/how-to-transform-a-json-object-into-flat-fields-in-watcher/250044/1 "2020-09-26T07:35:35Z")

</div>

we got a watcher to capture certain payload in json format. for example

```auto
"host":
"myserver": {
    "jvm": {
                {
                  "version": "14.0.1",
                  "vm_name": "OpenJDK",
                  "vm_vendor": "IBM"
                }
     }
}

```

these vary per payload. Hhow to make this into key-value fields, so each field can be indexed into another index as key-value fields. So the final outcome we looking for is as a single Event as below

```auto
2020-09-20 10:00:00 host.myserver.jvm.version: 14.0.1 host.myserver.jvm.vm_name: OpenJDK host.myserver.jvm.vm_vendor: IBM

```

Any generic transform to achieve such JSON parsing to flat fields?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [September 28, 2020, 8:48am UTC](https://discuss.elastic.co/t/how-to-transform-a-json-object-into-flat-fields-in-watcher/250044/2 "2020-09-28T08:48:59Z")

</div>

Take this as a starting point

```auto
GET _cat/indices

POST _watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "10h"
      }
    },
    "input": {
      "simple": {
        "foo": "bar",
        "host": {
          "foo" : "bar",
          "myserver": {
            "jvm": {
              "version": "14.0.1",
              "vm_name": "OpenJDK",
              "vm_vendor": "IBM"
            }
          }
        }
      }
    },
    "transform" : {
      "script" : {
        "lang" : "painless",
        "source" : """
void flatten(def map, def key, def value) {
  if (value instanceof String) {
    map[key] = value;
  } else if (value instanceof Map) {
    for (def entry : value.entrySet()) {
      def prefix = key != "" ? key + "." + entry.getKey() : entry.getKey();
      flatten(map, prefix, entry.getValue())
    }
  }
}
def map = [:];
flatten(map, "", ctx.payload);
return map;
        """
      }
    },
    "actions": {
      "logme": {
        "logging": {
          "text": "{{ctx.payload}}"
        }
      }
    }
  }
}

```

Note that the transform method does not take care of arrays yet, but should just give you a start.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 26, 2020, 8:49am UTC](https://discuss.elastic.co/t/how-to-transform-a-json-object-into-flat-fields-in-watcher/250044/3 "2020-10-26T08:49:14Z")

</div>

Closed on October 26, 2020, 8:49am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.