# JSON Array by index

**URL:** <https://discuss.elastic.co/t/json-array-by-index/176057>\
**Category:** Logstash\
**Created:** [April 9, 2019, 3:10pm UTC](https://discuss.elastic.co/t/json-array-by-index/176057 "2019-04-09T15:10:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jacob-N](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@Jacob-N](https://discuss.elastic.co/u/Jacob-N)\
**Post date:** [April 9, 2019, 3:10pm UTC](https://discuss.elastic.co/t/json-array-by-index/176057/1 "2019-04-09T15:10:05Z")

</div>

I am parsing a JSON from http\_poller. The JSON contains an array of coordinates with 3 numbers in the array. Only the first 2 are the lat and longitude and I would like to discard the 3rd number for the time being. Is it possible to parse a JSON array by the index of the value in the array?

example JSON array  
coor[5,6,7]

I would like to set 5 as lat 6 as lon  
This is not the proper syntax but similar to what I want to express.  
"location" =\> ["%{[coor][0]}","%{[coor][1]}"]

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 9, 2019, 3:51pm UTC](https://discuss.elastic.co/t/json-array-by-index/176057/2 "2019-04-09T15:51:36Z")

</div>

If you want location to be an object with lat and lon fields, then this would work

```
mutate { add_field => { "[location][lat]" => "%{[coor][1]}" "[location][lon]" => "%{[coor][0]}" } }

```

If you really just want an array with two entries I think you have to drop down into ruby

```
ruby { code => 'event.set("location", event.get("coor")[0..1])' }
```

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [April 10, 2019, 10:25am UTC](https://discuss.elastic.co/t/json-array-by-index/176057/3 "2019-04-10T10:25:57Z")

</div>

In addition to Badger's good reply, you can use mutate/copy providing that you create the location field's Array value first - needed because if the value is not a preset array type then the code will assume the nested fields are for a Hash value and you end up with fields `"0"` and `"1"` in a `location` Hash.

```auto
input {
  generator {
    message => '{"coor":[7,8,9]}'
    count => 1
  }
}

filter {
  json {
    source => "message"
    add_field => {"[location]" => [0,0]}
  }
  mutate {
     copy => {
      "[coor][0]" => "[location][0]"
      "[coor][1]" => "[location][1]"
    }
  }
}

output {
  stdout { codec => rubydebug {metadata => true } }
}

```

Gives:

```auto
{
          "coor" => [
        [0] 7,
        [1] 8,
        [2] 9
    ],
      "sequence" => 0,
    "@timestamp" => 2019-04-10T10:21:09.691Z,
          "host" => "Elastics-MacBook-Pro.local",
      "@version" => "1",
      "location" => [
        [0] 7,
        [1] 8
    ],
       "message" => "{\"coor\":[7,8,9]}"
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2019, 10:26am UTC](https://discuss.elastic.co/t/json-array-by-index/176057/4 "2019-05-08T10:26:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.