# How to use JSON Input to make filter on part of log
**URL:** https://discuss.elastic.co/t/how-to-use-json-input-to-make-filter-on-part-of-log/245570
**Category:** Kibana
**Created:** [August 19, 2020, 9:36am UTC](https://discuss.elastic.co/t/how-to-use-json-input-to-make-filter-on-part-of-log/245570 "2020-08-19T09:36:09Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@VooDooX](https://discuss.elastic.co/u/VooDooX)
#### Post date: [August 19, 2020, 9:36am UTC](https://discuss.elastic.co/t/how-to-use-json-input-to-make-filter-on-part-of-log/245570/1 "2020-08-19T09:36:09Z")
I have collected logs which are already imported into ELK.
Each log contains several fields, for ex date is different field.
Also there is complicated field "Details" which consist a lot of data: method: value, source: value, instrument: value and so on.
When I do histogram a choose number of logs on y-axis and date on x-axis.
So I get a lot of columns: from 0 to 100 of events (logs) in each column.
Question. Can I somehow do split series using sub aggregation adding as a filter instrument? I want to see each column with instruments also in addition to number of events each time period.
Example:
Log1
Date ddmmyy, hh:ss
…
Details: source: A, instrument: Car
…
Log2
Date ddmmyy, hh:ss
…
Details: source: A, instrument: Bike
…
How to make sub aggregation with instrument value?
Is it possible with JSON input: split series, filters, advanced, json input?
Thanks.
---
### Author:  [@VooDooX](https://discuss.elastic.co/u/VooDooX)
#### Post date: [August 19, 2020, 8:57pm UTC](https://discuss.elastic.co/t/how-to-use-json-input-to-make-filter-on-part-of-log/245570/2 "2020-08-19T20:57:48Z")
No ideas? Should I go to use script to create new fields that I need? It will update thousands and thousands of logs per day. ☹
---
### Author:  [@myasonik](https://discuss.elastic.co/u/myasonik)
#### Post date: [August 20, 2020, 6:46pm UTC](https://discuss.elastic.co/t/how-to-use-json-input-to-make-filter-on-part-of-log/245570/3 "2020-08-20T18:46:38Z")
Sounds like ideally you'd use a nested fields type for it though unfortunately we're just building out support for nested fields now so it's not ready for prime time in visualizations.
You can follow along on this issue:
>
>
> This is sort of a duplicate of some other issues I searched for but I haven't seen this particular aspect discussed,...
In the mean time, ideally you'd breakup the field before doing anything with it. If you're using logstash, it has a split filters plugin which can be used to do exactly this: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html#plugins-filters-split](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html#plugins-filters-split)
---
### Author:  [@VooDooX](https://discuss.elastic.co/u/VooDooX)
#### Post date: [August 21, 2020, 6:52am UTC](https://discuss.elastic.co/t/how-to-use-json-input-to-make-filter-on-part-of-log/245570/4 "2020-08-21T06:52:21Z")
Thanks, got it.
So as for now i'm working on rebuilding of my logs.
GL with nested fields.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 18, 2020, 6:52am UTC](https://discuss.elastic.co/t/how-to-use-json-input-to-make-filter-on-part-of-log/245570/5 "2020-09-18T06:52:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.