# JSON Array - Logstash

**URL:** <https://discuss.elastic.co/t/json-array-logstash/191819>\
**Category:** Logstash\
**Created:** [July 23, 2019, 1:08pm UTC](https://discuss.elastic.co/t/json-array-logstash/191819 "2019-07-23T13:08:50Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![shagun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shagun/32/59565_2.png) [@shagun](https://discuss.elastic.co/u/shagun)\
**Post date:** [July 23, 2019, 1:08pm UTC](https://discuss.elastic.co/t/json-array-logstash/191819/1 "2019-07-23T13:08:50Z")

</div>

I am trying to parse the nested JSON.  
I tried to use the `Split` filter for it but it results in a matric form.

```
{
    "School": {
    	"Details1": [{
    		"Name": "a",
    		"Class": "1"
    	}, {
    		"Name": "b",
    		"Class": "2"
    	}, {
    		"Name": "c",
    		"Class": "3"
    	}, {
    		"Name": "d",
    		"Class": "4"
    	}],

    "Details2": [{
    		"Name": "a",
    		"Class": "1"
    	}, {
    		"Name": "b",
    		"Class": "2"
    	}, {
    		"Name": "c",
    		"Class": "3"
    	}, {
    		"Name": "d",
    		"Class": "4"
    	}]
    }

```

the result I got is in matric like fields of Details1 **name a class 1** with the **name a class 1, name b class 2, name c class 3, name d class 4** of Details2

then the **name b class 2** of Details1 with the **name a class 1, name a class 2, name c class 3 and on...** of Details2.

so it is printing basically **4\*4** results.

Help me with that

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 23, 2019, 1:39pm UTC](https://discuss.elastic.co/t/json-array-logstash/191819/2 "2019-07-23T13:39:46Z")

</div>

Do you want Details1 and Details2 to be in separate events?

---

<div class="post-metadata">

**Author:** ![shagun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shagun/32/59565_2.png) [@shagun](https://discuss.elastic.co/u/shagun)\
**Post date:** [July 24, 2019, 4:30am UTC](https://discuss.elastic.co/t/json-array-logstash/191819/3 "2019-07-24T04:30:42Z")

</div>

Yes @Badger I want every "name" and "class" with **Details1** and **Details2** as separate events.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 24, 2019, 12:43pm UTC](https://discuss.elastic.co/t/json-array-logstash/191819/4 "2019-07-24T12:43:02Z")

</div>

Does this work for you?

```
    ruby {
        code => '
            a = []
            event.get("School").each { |k, v|
                a << v
            }
            event.set("SchoolArray", a)
        '
        remove_field => ["School"]
    }
    split { field => "SchoolArray" }

```

That will get you events that contain

```
"SchoolArray" => [
    [0] {
         "Name" => "a",
        "Class" => "1"
    },
    [1] {
         "Name" => "b",
        "Class" => "2"
    },
    [2] {
         "Name" => "c",
        "Class" => "3"
    },
    [3] {
         "Name" => "d",
        "Class" => "4"
    }
],
```

---

<div class="post-metadata">

**Author:** ![shagun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shagun/32/59565_2.png) [@shagun](https://discuss.elastic.co/u/shagun)\
**Post date:** [July 24, 2019, 1:25pm UTC](https://discuss.elastic.co/t/json-array-logstash/191819/5 "2019-07-24T13:25:42Z")

</div>

Thanks, @Badger this will work for only a single array.  
what about the fields of **Details2** , they also come as a separate document with the same name **SchoolArray**

I need Details1 in a single document and Details2 in another one.  
eg:

```
{
"Details1Array" => [
    [0] {
         "Name" => "a",
        "Class" => "1"
    },
    [1] {
         "Name" => "b",
        "Class" => "2"
    },
    [2] {
         "Name" => "c",
        "Class" => "3"
    },
    [3] {
         "Name" => "d",
        "Class" => "4"
    }
]
}

{
"Details2Array" => [
    [0] {
         "Name" => "a",
        "Class" => "1"
    },
    [1] {
         "Name" => "b",
        "Class" => "2"
    },
    [2] {
         "Name" => "c",
        "Class" => "3"
    },
    [3] {
         "Name" => "d",
        "Class" => "4"
    }
]
}

```

can you help me with this?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 24, 2019, 1:30pm UTC](https://discuss.elastic.co/t/json-array-logstash/191819/6 "2019-07-24T13:30:02Z")

</div>

You could change the ruby filter to

```
    ruby {
        code => '
            a = []
            event.get("School").each { |k, v|
                a << { k => v }
            }
            event.set("SchoolArray", a)
        '
        remove_field => ["School"]
    }

```

which would get you events like

```
"SchoolArray" => {
    "Details2" => [
        [0] {
            "Class" => "1",
             "Name" => "a"
        },
        [1] {
            "Class" => "2",
             "Name" => "b"
        },
        [2] {
            "Class" => "3",
             "Name" => "c"
        },
        [3] {
            "Class" => "4",
             "Name" => "d"
        }
    ]
},
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2019, 1:30pm UTC](https://discuss.elastic.co/t/json-array-logstash/191819/7 "2019-08-21T13:30:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.