# JSON data from ansible
**URL:** https://discuss.elastic.co/t/json-data-from-ansible/71995
**Category:** Elasticsearch
**Created:** [January 18, 2017, 11:56am UTC](https://discuss.elastic.co/t/json-data-from-ansible/71995 "2017-01-18T11:56:41Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@dsever](https://discuss.elastic.co/u/dsever)
#### Post date: [January 18, 2017, 11:56am UTC](https://discuss.elastic.co/t/json-data-from-ansible/71995/1 "2017-01-18T11:56:41Z")
Hi,
For one of my projects I'm trying to sue ELK for logging ansible events. I'm suing callback module from [https://github.com/ujenmr/ansible-logstash-callback](https://github.com/ujenmr/ansible-logstash-callback). And it communicates with logstash and logstash sends it to elastic., and everything looks ok, but there is always "but"
At Logstash level ansible\_result is string.
{"ansible\_type":"task","level":"INFO","ansible\_result":"{"changed": false, "debug": "", "msg": "XXXX", "results": [{"login\_encrypt\_method": {"msg": "Zadovoljavajuci algoritam sazimanja sha512", "status": "true"}}], "stderr": null, "stdout": " password hashing algorithm is sha512\n", "stdout\_lines": [" password hashing algorithm is sha512"]}","session":"XXX","message":"ansible ok","type":"ansible","ansible\_playbook":"security-.yml","ansible\_task":"Provjera primjene enkripcije na md5 ili ili shaX (kao argument uzima se tip potpisa)","logger\_name":"python-logstash-logger","status":"OK"}
One of the most information from here is ansible\_result, but logstash receives input as json.dump, like string, and elastic saves this field as string not as json.
So what I'm trying to accomplish here to have structure like:
"ansible\_results":{
"changed":"true",
"msg": "Somme message"...
}
So i can be searchable using Kibana.
I've also tried to form by removing trailing staring " and ending " character, so logstash sends it to elastic as json, but than it doesn't logs anything in elasticsearch.
I don't have so much experince with cases like this one, so any ides would be great.
Thanks
---
### Author:  [@mainec](https://discuss.elastic.co/u/mainec)
#### Post date: [January 18, 2017, 1:17pm UTC](https://discuss.elastic.co/t/json-data-from-ansible/71995/2 "2017-01-18T13:17:14Z")
I believe you might have better luck asking that question over in the logstash category of this forum. Maybe the following filter already helps you:
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html)
One reason why your approach of removing just the leading and trailing " doesn't work I assume is that this still leaves the content inside as quoted json.
Hope this helps,
Isabel
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 15, 2017, 1:18pm UTC](https://discuss.elastic.co/t/json-data-from-ansible/71995/3 "2017-02-15T13:18:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.