# Json array split using logstash **URL:** \ **Category:** Logstash\ **Created:** [September 24, 2020, 8:16pm UTC](https://discuss.elastic.co/t/json-array-split-using-logstash/249876 "2020-09-24T20:16:12Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![subash](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/subash/32/59912_2.png) [@subash](https://discuss.elastic.co/u/subash)\ **Post date:** [September 24, 2020, 8:16pm UTC](https://discuss.elastic.co/t/json-array-split-using-logstash/249876/1 "2020-09-24T20:16:13Z")
I have a jason array like the below ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/c/fcd0f348d816ed36bdcce17e9a6a9c080d7f2d40.png) The split filter is working till **sdwan.status** `split { field =\> "[parsed\_collection][collection][sdwan:status]" } when I try to split till **path-status** like this **split { field =\> "[parsed\_collection][collection][sdwan:status][path-status]" }** it is throwing the below error. "Only String and Array types are splittable" expecting the output like the below. parsed\_collection.collection.sdwanstatus.path-status.fwd-class fc\_nc parsed\_collection.collection.sdwanstatus.path-status.path-handle 6885632 parsed\_collection.collection.sdwanstatus.path-status.conn-state up parsed\_collection.collection.sdwanstatus.path-status.remote-wan-link MPLS parsed\_collection.collection.sdwanstatus.path-status.damp-flaps 0 parsed\_collection.collection.sdwanstatus.path-status.local-wan-link WAN parsed\_collection.collection.sdwanstatus.path-status.last-flapped 2d12h04m parsed\_collection.collection.sdwanstatus.path-status.remote-wan-link-id 1 parsed\_collection.collection.sdwanstatus.path-status.local-wan-link-id 1 parsed\_collection.collection.sdwanstatus.path-status.adaptive-monitoring disable parsed\_collection.collection.sdwanstatus.path-status.damp-state disable parsed\_collection.collection.sdwanstatus.path-status.flaps 1 Please help me to split till path-status @Badger ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 24, 2020, 9:30pm UTC](https://discuss.elastic.co/t/json-array-split-using-logstash/249876/2 "2020-09-24T21:30:32Z")
What does that object look like if you use ``` output { stdout { codec => rubydebug } } ``` ---
**Author:** ![subash](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/subash/32/59912_2.png) [@subash](https://discuss.elastic.co/u/subash)\ **Post date:** [September 24, 2020, 11:18pm UTC](https://discuss.elastic.co/t/json-array-split-using-logstash/249876/3 "2020-09-24T23:18:35Z")
@Badger The object looks like the below ```auto "parsed_collection" => { "collection" => { "sdwan:status" => [ [0] { "path-status" => [ [0] { "remote-wan-link-id" => 1, "adaptive-monitoring" => "disable", "flaps" => 8, "damp-flaps" => 0, "conn-state" => "up", "path-handle" => 69888, "local-wan-link-id" => 1, "last-flapped" => "5d03h01m", "remote-wan-link" => "WAN", "local-wan-link" => "WAN", "fwd-class" => "fc_nc", "damp-state" => "disable" } ], "site-name" => "POD3-Controller1" }, [1] { "path-status" => [ [0] { "remote-wan-link-id" => 1, "adaptive-monitoring" => "disable", "flaps" => 1, "damp-flaps" => 0, "conn-state" => "up", "path-handle" => 6885632, "local-wan-link-id" => 1, "last-flapped" => "2d15h44m", "remote-wan-link" => "MPLS", "local-wan-link" => "WAN", "fwd-class" => "fc_nc", "damp-state" => "disable" }, [1] { "remote-wan-link-id" => 2, "adaptive-monitoring" => "disable", "flaps" => 1, "damp-flaps" => 0, "conn-state" => "up", "path-handle" => 6885888, "local-wan-link-id" => 1, "last-flapped" => "2d15h44m", "remote-wan-link" => "INT", "local-wan-link" => "WAN", "fwd-class" => "fc_nc", "damp-state" => "disable" } ], "site-name" => "ind-uat-matrix-cgw1" }, [2] { "path-status" => [ [0] { "remote-wan-link-id" => 1, "adaptive-monitoring" => "disable", "flaps" => 1, "damp-flaps" => 0, "conn-state" => "up", "path-handle" => 6951168, "local-wan-link-id" => 1, "last-flapped" => "2d10h43m", "remote-wan-link" => "MPLS", "local-wan-link" => "WAN", "fwd-class" => "fc_nc", "damp-state" => "disable" }, [1] { "remote-wan-link-id" => 2, "adaptive-monitoring" => "disable", "flaps" => 1, "damp-flaps" => 0, "conn-state" => "up", "path-handle" => 6951424, "local-wan-link-id" => 1, "last-flapped" => "2d10h43m", "remote-wan-link" => "INT", "local-wan-link" => "WAN", "fwd-class" => "fc_nc", "damp-state" => "disable" } ], "site-name" => "ind-uat-matrix-cgw2" } ] } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 25, 2020, 12:19am UTC](https://discuss.elastic.co/t/json-array-split-using-logstash/249876/4 "2020-09-25T00:19:29Z")
> [@subash](#): > > ```auto > "parsed_collection" => { > "collection" => { > "sdwan:status" => [ > [0] { > "path-status" => [ > [0] { > "remote-wan-link-id" => 1, > > ``` So [sdwan:status] is an array, and for each entry in that array, the field [path-status] is also an array. I have not tested anything, but I think you will need two split filters. ``` split { field => "[parsed_collection][collection][sdwan:status]" } split { field => "[parsed_collection][collection][sdwan:status][path-status]" } ``` kibana does not always display object structures within fields very well. It is just not what the tool is intended to do. Looking at the rubydebug output from logstash, or the raw JSON in the \_source field from elasticsearch will give a better presentation of the structure. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 23, 2020, 12:19am UTC](https://discuss.elastic.co/t/json-array-split-using-logstash/249876/5 "2020-10-23T00:19:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.