# JSON Array in Logstash

**URL:** https://discuss.elastic.co/t/json-array-in-logstash/25655
**Category:** Logstash
**Created:** [July 15, 2015, 5:18pm UTC](https://discuss.elastic.co/t/json-array-in-logstash/25655 "2015-07-15T17:18:55Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![BZen](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@BZen](https://discuss.elastic.co/u/BZen)
#### Post date: [July 15, 2015, 5:18pm UTC](https://discuss.elastic.co/t/json-array-in-logstash/25655/1 "2015-07-15T17:18:55Z")

</div>

I have a field which look like this.

```
"log":"[{\"id\":\"1233\"}, ...some more json]

```

I want to have a field like

```
id => 1233

```

I tried using json filter plugin but I am getting a parse error. What is the ideal way of doing this?

---

<div class="post-metadata">

### Author: ![suyograo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suyograo/32/44898_2.png) [@suyograo](https://discuss.elastic.co/u/suyograo)
#### Post date: [July 23, 2015, 1:25am UTC](https://discuss.elastic.co/t/json-array-in-logstash/25655/2 "2015-07-23T01:25:34Z")

</div>

You can use the logstash-codec-json to achieve this. We recently added support for arrays in json. Each array entry will become a new event.

> <https://github.com/logstash-plugins/logstash-codec-json/pull/13>

Available in 1.5.3

---

<div class="post-metadata">

### Author: ![vmcano](https://avatars.discourse-cdn.com/v4/letter/v/f1d935/32.png) [@vmcano](https://discuss.elastic.co/u/vmcano)
#### Post date: [September 24, 2015, 2:23pm UTC](https://discuss.elastic.co/t/json-array-in-logstash/25655/3 "2015-09-24T14:23:52Z")

</div>

I've tried json codec and json filter and none of them worked for me.  
I have the following JSON:

```
{"event":{"id":"we4gh64jm3c5v4b8h7gjz","origin":{"idTrace":[],"idRequest":null,"application":{"id":null,"type":null}},"principal":null,"priority":1,"code":200,"headers":{},"payload":[{"Cod":"2544199","Or":[{"StsCod":"0","CodRen":1}]},{"Con":"7499563","Ox":[{"Cod":"2","Ren":1},{"Sts":"0","Cod":1}]}],"replyTo":null,"timestamp":1441275222216},"invalidRequest":false,"internalError":false}

```

It works fine except for the event.payload field which contains the JSON array unparsed.

When I tried in the input part, the config was:

```
input {
  lumberjack {
    # The port to listen on
    port => 5043

    # The paths to your ssl cert and key
    ssl_certificate => "/opt/pki/logstash-forwarder.crt"
    ssl_key => "/opt/pki/logstash-forwarder.key"

    codec => json
  }
}

```

And when I tried in the filter part:

```
filter {
    json {
        source => "message"
    }
}

```

Any idea?

Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:28am UTC](https://discuss.elastic.co/t/json-array-in-logstash/25655/4 "2017-07-06T05:28:07Z")

</div>