# Json field parsing , multi value field **URL:** \ **Category:** Logstash\ **Created:** [August 14, 2017, 5:40pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005 "2017-08-14T17:40:31Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![shaileshmali](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@shaileshmali](https://discuss.elastic.co/u/shaileshmali)\ **Post date:** [August 14, 2017, 5:40pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005/1 "2017-08-14T17:40:31Z")
I want to parse json message . I am using add\_field option as i do not need all fields from the message. landingPlatformCode field has mutiple values . given bellow exmample to pull first value. There might be 1 ,2 ,3 4,5 values or just one value in this field. if [EventStreamData][response][landingURL][0][landingPlatformCode] { mutate { add\_field =\> {"landingPlatformCode" =\> "%{[EventStreamData][response][landingURL][0][landingPlatformCode]}" } } } Want to use ruby code to loop through this field values ``` if [EventStreamData][response][landingURL] { ruby { code => " event[EventStreamData][response][landingURL].each { |kv| event[kv['key']] = kv['value'] unless kv['value'].nil? mutate { add_field => {"landingPlatformCode" => "%{[EventStreamData][response][landingURL][0][landingPlatformCode]}" } } } " } ``` This roby code does not work. Please suggest how can modify this code to work for just one of the field with mutiple key value pairs. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 14, 2017, 8:16pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005/2 "2017-08-14T20:16:00Z")
Which version of Logstash is this? What does an example input message look like? You can't put a mutate filter inside your ruby filter's code block. ---
**Author:** ![shaileshmali](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@shaileshmali](https://discuss.elastic.co/u/shaileshmali)\ **Post date:** [August 15, 2017, 5:56pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005/3 "2017-08-15T17:56:20Z")
Logstash version is 5.5 Sample test log . End of the message has landingURL with multiple values. * * * {"StreamMessageContext":{"app":"Test","serverIP":"10.207.170.38","instanceName":"defaultDomain","correlationId":"EAS-AND-F0BBDC86-ED3A-4B62-8A49-FC3088B83C9C"},"EventStreamData":{"status":1,"httpStatus":200,"dispositionCode":1,"eventName":"5000027","requestContext":{"pragmaNoStore":false,"requestCookies":[],"vipUrlHostPortPrefix":"[http://api-it.cloud.example.com:443](http://api-it.cloud.example.com:443)","policyDecisionPoint":"eAPI\_PDP","oauth2ResourceOwnerUID":"UNDEFINED","pragmaNoCache":true,"userId":"ANONYMOUS","rsaCorrelationId":"UNDEFINED","eventEndTime":"2017-08-08 13:20:11.663 +00:00","clientIP":"10.207.170.38","eventStartTime":"2017-08-08 13:20:11.182 +00:00","webAnalyticsCorrelationId":"|","applicationCode":"ISSO","domainName":"defaultDomain","correlationId":"EAS-AND-F0BBDC86-ED3A-4B62-8A49-FC3088B83C9C","applicationName":"customers-logins-app","allRequestHeaders":{"accept":["application/json;v=4"],"accept-encoding":["gzip"],"accept-language":["en-us"],"api-key":["MOBILE"],"cache-control":["no-cache"],"channel-type":["MOBILE"],"client-correlation-id":["EAS-AND-F0BBDC86-ED3A-4B62-8A49-FC3088B83C9C"],"client-ip":["10.207.45.231"],"client\_id":["0cdca3b725074d359841e1f9a067d29b"],"connection":["keep-alive"],"content-length":["2500"],"content-type":["application/json"],"correlation-id":["F0BBDC86-ED3A-4B62-8A49-FC3088B83C9C"],"country-code":["US"],"ct\_request\_id":["82152"],"customer-ip-address":["10.207.45.231"],"device-id":["774random7device2id4"],"edge-context-id":["396334eb-4cea-4990-9517-a2824a932609"],"endpoint\_id":["6617a32ac9e24ef6b4eee3bb3686a134"],"forwarded":["for=10.207.32.121;proto=https;[host:443=api-it.cloud.example.com](http://host:443=api-it.cloud.example.com)"],"host":["[it.example.com](http://it.example.com)"],"pragma":["no-cache"],"user-agent":["Dalvik/2.1.0 (Linux; U; Android 5.1; XT1032 Build/LMY47M.M005)"],"x-apigw-app-id":["9d95ebde6aa64208a45b0c4b5bc6b944"],"x-apigw-key":["CapiOne-IT-INT-10.207.175.150"],"x-apigw-origin-client-id":["0cdca3b725074d359841e1f9a067d29b"],"x-apigw-resolved-upstream-env":["QA"],"x-apigw-upstream-backend-id":["9562ad1a-4cf8-4e4b-9e17-0e62741577c7"],"x-client-id":["0cdca3b725074d359841e1f9a067d29b"],"x-forwarded-cn":["[rtmqa-client.example.com](http://rtmqa-client.example.com)"],"x-forwarded-for":["10.207.45.231, 10.207.55.131, 10.207.32.121, 10.207.175.150"],"x-forwarded-host":["[api-it.cloud.example.com](http://api-it.cloud.example.com)"],"x-forwarded-port":["443"],"x-forwarded-proto":["https"],"x-forwarded-server":["[Mobile-e-qa-cr-mobile-ip-10-207-53-103.dqa.example.com](http://Mobile-e-qa-cr-mobile-ip-10-207-53-103.dqa.example.com)"],"x-message-id":["10.207.175.150-c823e8a4-9dd7-4a0e-a303-8d3d1ef34670","10.207.175.150-c823e8a4-9dd7-4a0e-a303-8d3d1ef34670"],"x-newrelic-id":["UAUGV1JRGwEEV1hQAgg="],"x-real-ip":["10.207.32.121"]},"locale":"en\_US","messageId":"10.207.175.150-c823e8a4-9dd7-4a0e-a303-8d3d1ef34670","notNull":true},"args":{"customerLoginRequest":{"username":"Bx5sJaLDNFMcrUOp7bENhTNeXyOZFte+kkPhw5uoiKoMWQIQwd+C5d0edJ6d0kczKl8UfpzgjIptHxJ9c7wU8H/9aKnO4WSq1lRayD72anbYPjuHYFOsYqNJWdwnBvpImp+b+BkKBlwN8SyoklR2b0znwNWa1XKsuJka77Yb5jc=","authenticationMethod":"Password","authenticationMode":"Authenticate","device":{"authenticationDeviceId":"hO9MgzRiAycCZgacosGV3Z+kGlVAR8HxLmGL2p4VXwXVzeQYuyanyfRAFJ8DTxqU2jqSqp7ndxJ6fLJdNSzAAD8VgYpIZ3nsE9baEWECRxLFoX2glB2WM7FuLfr7+tMCR6JRvkn1V36AOuG9XtdCRy5mc81tdvIiEeoXk8WtB5kJDtMSrzp4xU3bCV1GfLz3FuEdsFLk/8nyKRITwel13esYXdbMFj6mMaBCK7+/4ovwALi2i4AgGx0OoRoCrafq0qy76JZdMFVoLwCN7jHW/7w1PbjtYKnMGwASIjZR/14I/KhkdXK9+RZ3hIIds0EGRGP2RvJWxoDnoFXmHtDvaA==","deviceModel":"XT1032","devicePlatform":"android","deviceType":"Android","deviceOperatingSystem":"android","deviceOperatingSystemVersion":"5.1","deviceNickname":"falcon\_umts","appName":"com.capitalone.mobilebanking.dev.debug","appVersion":"1613230500","appEnvironment":"android"},"riskAssessment":{"mobile":{"mobileSdkInfo":"{"TIMESTAMP":"2016-08-17T15:24:37Z","HardwareID":"359278059115484","DeviceModel":"XT1032","MultitaskingSupported":true,"DeviceName":"falcon\_umts","DeviceSystemName":"Android","DeviceSystemVersion":"22","Languages":"en","WiFiMacAddress":"14:30:c6:f4:a6:24","ScreenSize":"720x1184","RSA\_ApplicationKey":"155DF45852AC5535347F2CCF9B9D02DF","OS\_ID":"774random7device2id4","SDK\_VERSION":"2.0.1","Compromised":0,"Emulator":0,"OperatorName":"","OperatorCode":"","OperatorISO":"","SimCountryCode":"","SimOperator":""}","deviceSdkInfo":"{"TIMESTAMP":"2016-08-17T15:24:37Z","HardwareID":"359278059115484","DeviceModel":"XT1032","MultitaskingSupported":true,"DeviceName":"falcon\_umts","DeviceSystemName":"Android","DeviceSystemVersion":"22","Languages":"en","WiFiMacAddress":"14:30:c6:f4:a6:24","ScreenSize":"720x1184","OS\_ID":"774random7device2id4","SDK\_VERSION":"1.0.0","Compromised":0,"Emulator":0,"OperatorName":"","OperatorCode":"","OperatorISO":"","SimCountryCode":"","SimOperator":""}","universalDeviceIdentifier":"774random7device2id4"}},"sessionId":"EAS-AND-F0BBDC86-ED3A-4B62-8A49-FC3088B83C9C"}},"response":{"profileReferenceId":"4dWFRyIdC188NMLK+tMB3NKEgRrHO1f556/y0pEiwuIm1nBkLzSj6HountD4y8ve","platforms":[{"platformCode":"Test1"},{"platformCode":"Test2"},{"platformCode":"Test3"},{"platformCode":"Test4"},{"platformCode":"Test5"}],"landingURL":[{"landingPlatformCode":"AVAILABLE\_PRODUCTS","landingPlatformURL":"[https://verified-it.example.com/sic-ui/#/pathFinder"},{"landingPlatformCode":"360BANK","landingPlatformURL":"https://secure-qa2.int.example360qa.com/myaccount/banking/postlogin"},{"landingPlatformCode":"CTRACKER","landingPlatformURL":"https://preprod-creditwise.example.com/#/authenticated"},{"landingPlatformCode":"CARD","landingPlatformURL":"https://cosqa4.example.com/accounts/?initial\_login=true"},{"landingPlatformCode":"OLBANK","landingPlatformURL":"https://olbrqa5.example.com/olb-web/entry"}],"loginStatus":"SUCCESS","ssoId":"310d8fdc98b647f5d9f8c3d831a28892","mobileOnly](https://verified-it.example.com/sic-ui/#/pathFinder%22%7D,%7B%22landingPlatformCode%22:%22360BANK%22,%22landingPlatformURL%22:%22https://secure-qa2.int.example360qa.com/myaccount/banking/postlogin%22%7D,%7B%22landingPlatformCode%22:%22CTRACKER%22,%22landingPlatformURL%22:%22https://preprod-creditwise.example.com/#/authenticated%22%7D,%7B%22landingPlatformCode%22:%22CARD%22,%22landingPlatformURL%22:%22https://cosqa4.example.com/accounts/?initial_login=true%22%7D,%7B%22landingPlatformCode%22:%22OLBANK%22,%22landingPlatformURL%22:%22https://olbrqa5.example.com/olb-web/entry%22%7D%5D,%22loginStatus%22:%22SUCCESS%22,%22ssoId%22:%22310d8fdc98b647f5d9f8c3d831a28892%22,%22mobileOnly)":false}}} ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 15, 2017, 7:08pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005/4 "2017-08-15T19:08:49Z")
Please post the JSON blob as preformatted text so it doesn't get mangled. I don't want to waste time fixing the broken JSON just to be able to read it properly and see its structure. ---
**Author:** ![shaileshmali](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@shaileshmali](https://discuss.elastic.co/u/shaileshmali)\ **Post date:** [August 25, 2017, 2:25pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005/5 "2017-08-25T14:25:17Z")
{"StreamMessageContext":{"appName":"ISSO","serverIP":"10.207.169.114","instanceName":"defaultDomain","correlationId":"EAS-AND-raj"},"EventStreamData":{"status":1,"httpStatus":200,"dispositionCode":1,"eventName":"5000027","requestContext":{"pragmaNoCache":true,"pragmaNoStore":false,"requestCookies":[],"policyDecisionPoint":"eAPI\_PDP","eventEndTime":"2017-08-17 17:10:21.309 +00:00","oauth2ResourceOwnerUID":"UNDEFINED","rsaCorrelationId":"UNDEFINED","vipUrlHostPortPrefix":"[http://api-it.cloud.exampleone.com:443](http://api-it.cloud.exampleone.com:443)","applicationCode":"ISSO","webAnalyticsCorrelationId":"|","eventStartTime":"2017-08-17 17:10:20.894 +00:00","correlationId":"EAS-AND-raj","applicationName":"customers-logins-app","allRequestHeaders":{"accept":["application/json;v=4"],"accept-encoding":["gzip"],"accept-language":["en-US"],"accept-type":["application/json"],"api-key":["MOBILE"],"app-auth-token":["ZXlKaGJHY2lPaUpCTVRJNFMxY2lMQ0psYm1NaU9pSkJNVEk0UTBKRExVaFRNalUySW4wLlVtc19qTFhKTzVUMTBLNzRYb2dWN1VUVXpLRTVxdUxjbjR5dFFlUnAzUkhBMDVCVERiWV9xdy54SjU5LVBmNHBLNm5yWldhQ2xkUkpBLjR1VTE1cWEtSDFCWUFkNE1QeFBZWGxfUlJ3NnFFOURZaVNNbjJsejNuU0N6d1pmN0hLMnJFdXRIMUhLLXcxeWhfeFhJdmQ3eUIyTlRXT2NYM0xxb0l5S1JNUzRpSkpSTnJ2RnlsOFRnSnhTbm1ueVFiblZsWGJuTWVGLTRwQWdEOVZIUU1XLXZvbDBCVF81ZE1HTlRrNHRyRWNZWXFyNDN1QjR0aVlGS2RDSF9HU3JwT1V4NVIydVhLWEpKbnh6LVpaMC1YN2p4QU5nY3ktNTVrWFk2VEQyZDE3cTdiMmVCVktveHZlb2NoSVFISVQ4RElYMG44bXlHTmpQODNRN2hMUEJaV3V0ZGFZMF9WZVBuU2d0bzlDVFpMcjlxNElGdlVQVzBQTGhOemtLWl92eUJaa0lqLWRCcE16QlVPcGFBLWxzQXMzTGtHWC1WOUVsUkY2NzU4dy5MWm1fRE8yVW1tcGtqNE1xR29KZmhR"],"cache-control":["no-cache"],"channel-type":["MOBILE"],"client-correlation-id":["EAS-AND-raj"],"client-ip":["10.212.113.158"],"client\_id":["0cdca3b725074d359841e1f9a067d29b"],"connection":["keep-alive"],"content-length":["2066"],"content-type":["application/json"],"country-code":["US"],"ct\_request\_id":["18198"],"customer-ip-address":["10.212.113.158"],"device-id":["6b7d17e26ef315a8"],"edge-context-id":["1e6da2dc-706c-4349-8e95-7190177c4578"],"endpoint\_id":["6617a32ac9e24ef6b4eee3bb3686a134"],"forwarded":["for=10.207.33.20;proto=https;[host:443=api-it.cloud.exampleone.com](http://host:443=api-it.cloud.exampleone.com)"],"host":["[sicapis-ite.clouddqt.exampleone.com](http://sicapis-ite.clouddqt.exampleone.com)"],"user-agent":["rest-client/2.0.2 (darwin13.4.0 x86\_64) ruby/2.2.2p95"],"x-apigw-app-id":["9d95ebde6aa64208a45b0c4b5bc6b944"],"x-apigw-key":["CapiOne-IT-INT-10.207.160.157"],"x-apigw-origin-client-id":["0cdca3b725074d359841e1f9a067d29b"],"x-apigw-resolved-upstream-env":["QA"],"x-apigw-upstream-backend-id":["9562ad1a-4cf8-4e4b-9e17-0e62741577c7"],"x-client-id":["0cdca3b725074d359841e1f9a067d29b"],"x-forwarded-cn":["[rtmqa-client.xyz.exampleone.com](http://rtmqa-client.xyz.exampleone.com)"],"x-forwarded-for":["10.212.113.158, 10.212.113.110, 10.207.55.131, 10.207.33.20, 10.207.160.157"],"x-forwarded-host":["[api-it.cloud.exampleone.com](http://api-it.cloud.exampleone.com)"],"x-forwarded-port":["443"],"x-forwarded-proto":["https"],"x-forwarded-server":["[Mobile-e-qa-cr-mobile-ip-10-207-39-117.dqa.exampleone.com](http://Mobile-e-qa-cr-mobile-ip-10-207-39-117.dqa.exampleone.com)"],"x-message-id":["10.207.160.157-5cdc90cc-3a0a-4558-baa7-d5ead2d237db","10.207.160.157-5cdc90cc-3a0a-4558-baa7-d5ead2d237db"],"x-real-ip":["10.207.33.20"]},"userId":"ANONYMOUS","domainName":"defaultDomain","clientIP":"10.207.169.114","locale":"en\_US","notNull":true,"messageId":"10.207.160.157-5cdc90cc-3a0a-4558-baa7-d5ead2d237db"},"args":{"customerLoginRequest":{"username":"LxVt+q2xu9IxB45k1y5ro2/GejqkajDqHcz0sNoCbPnyodEkfS0ZafmG/RsdWjBTZS8Uj4rtypsWnslbHnJaQUaWJcnpPFIGtIkrV9UsDBRNcypw+vtmnt1hSQR5V/V47J7WUNGj7CzVna+2qfOVrQLJeoEPt52XpjS/99h/Qp7RAjlstaPjFD0uvNIFt/pzSjckne7ZRyazCjVzI7cukZy9OQjGRHTQoVpQ1XnI5gXDsGyfzNnYL1kAIu4aUdQ6zj2ZdmDDIW2/2bWG1O5umMF7L17+O5jkgGtxqmlG6oHGD9qtRkkxQywmHkARzpaE0LfbWjGBdGKPlu5k2Enj8A==","authenticationMethod":"Password","authenticationMode":"AUTHENTICATE","device":{"authenticationDeviceId":"vszUyrQzY84IUm3RfIxPWdakysjEecl201McNBK3b3sK2B+zXAIhNUvaObWlc2DDtm1K81QlmoxkMI5UUuHCqkIPcaU5eWVbDu6MPHNEmV63kdNqSHi8ye8Mvmb5d7YhZyi2bC+6bS0bs6BhlYYPCPN/iW4GI6KNW8HF+CjIGWIqek/Cb5RHcHlCDfLeq/ODfPj1WOB83KCMqo7SfVjiEPWXgLmCBIY7OzodXLk9nInVEWf6jUZ8zNYRQEYYV+fYgPJvJP3PIA87wtU0x/MfGbt1Ctk8WdBVMWlPrX6WdOoBwTsgftZDCJ0HGfd7dGWaDDpQURphbB0A6xU8Yh7Jlg==","deviceModel":"iPad2","devicePlatform":"iPad","deviceType":"iPhone","deviceOperatingSystem":"ios","deviceOperatingSystemVersion":"7","deviceNickname":"PersonalIPad","appName":"Wallet","appVersion":"1.0.0","appEnvironment":"ios"},"riskAssessment":{"mobile":{"phoneNumber":"2134071411","mobileSdkInfo":"{ "DeviceSystemVersion" : "9.0.2", "HardwareID" : "4D2DA09D666D4BB6ADCB42476F925C3C", "ScreenSize" : "375 x 667", "Languages" : "en-US", "MultitaskingSupported" : true, "DeviceModel" : "iPhone", "RSA\_ApplicationKey" : "50A77F047BDCDA73EC511CD5337004C8", "WiFiMACAddress" : "4D2DA09D666D4BB6ADCB42476F925C3C", "TIMESTAMP" : "2015-10-09T19:35:52Z", "Emulator" : 0, "OtherId" : "4D2DA09D-666D-4BB6-ADCB-42476F925C3C", "OS\_ID" : "00F6B812-4D96-4DFC-B6EF-A4B455017E78", "Compromised" : 0, "DeviceSystemName" : "iPhone OS", "DeviceName" : "iPhone (5)", "SDK\_VERSION" : "2.0.1" }","simId":"12122","universalDeviceIdentifier":"1D4031AB-0DD4-4699-952A-08688CFF"}},"signInPlatform":"EOS","sessionId":"EAS-AND-raj"}},"response":{"profileReferenceId":"9vX84mj85yu79fg/sHRhKmrFhN0Px+dk9EO8o+Ia8q5IUDx6CGaUHaXRhkE9KVEn","platforms":[{"platformCode":"360"},{"platformCode":"EASE"},{"platformCode":"EOS"}],"landingURL":[{"landingPlatformCode":"AVAILABLE\_PRODUCTS","landingPlatformURL":"[https://verified-it.exampleone.com/sic-ui/#/pathFinder"},{"landingPlatformCode":"360BANK","landingPlatformURL":"https://secure-qa2.int.exampleone360qa.com/myaccount/banking/postlogin"},{"landingPlatformCode":"CARD","landingPlatformURL":"https://cosqa4.xyz.exampleone.com/accounts/?initial\_login=true"}],"loginStatus":"CHALLENGE","ssoId":"df2dae743fda82fb804e97dcd27eb2b3","mobileOnly](https://verified-it.exampleone.com/sic-ui/#/pathFinder%22%7D,%7B%22landingPlatformCode%22:%22360BANK%22,%22landingPlatformURL%22:%22https://secure-qa2.int.exampleone360qa.com/myaccount/banking/postlogin%22%7D,%7B%22landingPlatformCode%22:%22CARD%22,%22landingPlatformURL%22:%22https://cosqa4.xyz.exampleone.com/accounts/?initial_login=true%22%7D%5D,%22loginStatus%22:%22CHALLENGE%22,%22ssoId%22:%22df2dae743fda82fb804e97dcd27eb2b3%22,%22mobileOnly)":false}}}`Preformatted text` ---
**Author:** ![shaileshmali](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@shaileshmali](https://discuss.elastic.co/u/shaileshmali)\ **Post date:** [August 25, 2017, 2:34pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005/6 "2017-08-25T14:34:57Z")
Please let me know if you can see this message properly . ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 25, 2017, 8:37pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005/7 "2017-08-25T20:37:07Z")
Still not right. Just put ```` ``` ```` (three backticks) before and after the JSON text or use the `` toolbar button. This isn't rocket science. ---
**Author:** ![shaileshmali](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@shaileshmali](https://discuss.elastic.co/u/shaileshmali)\ **Post date:** [August 25, 2017, 9:04pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005/8 "2017-08-25T21:04:43Z")
`{"StreamMessageContext":{"appName":"ISSO","serverIP":"10.207.169.114","instanceName":"defaultDomain","correlationId":"EAS-AND-raj"},"EventStreamData":{"status":1,"httpStatus":200,"dispositionCode":1,"eventName":"5000027","requestContext":{"pragmaNoCache":true,"pragmaNoStore":false,"requestCookies":[],"policyDecisionPoint":"eAPI_PDP","eventEndTime":"2017-08-17 17:10:21.309 +00:00","oauth2ResourceOwnerUID":"UNDEFINED","rsaCorrelationId":"UNDEFINED","vipUrlHostPortPrefix":"http://api-it.cloud.exampleone.com:443","applicationCode":"ISSO","webAnalyticsCorrelationId":"|","eventStartTime":"2017-08-17 17:10:20.894 +00:00","correlationId":"EAS-AND-raj","applicationName":"customers-logins-app","allRequestHeaders":{"accept":["application/json;v=4"],"accept-encoding":["gzip"],"accept-language":["en-US"],"accept-type":["application/json"],"api-key":["MOBILE"],"app-auth-token":["ZXlKaGJHY2lPaUpCTVRJNFMxY2lMQ0psYm1NaU9pSkJNVEk0UTBKRExVaFRNalUySW4wLlVtc19qTFhKTzVUMTBLNzRYb2dWN1VUVXpLRTVxdUxjbjR5dFFlUnAzUkhBMDVCVERiWV9xdy54SjU5LVBmNHBLNm5yWldhQ2xkUkpBLjR1VTE1cWEtSDFCWUFkNE1QeFBZWGxfUlJ3NnFFOURZaVNNbjJsejNuU0N6d1pmN0hLMnJFdXRIMUhLLXcxeWhfeFhJdmQ3eUIyTlRXT2NYM0xxb0l5S1JNUzRpSkpSTnJ2RnlsOFRnSnhTbm1ueVFiblZsWGJuTWVGLTRwQWdEOVZIUU1XLXZvbDBCVF81ZE1HTlRrNHRyRWNZWXFyNDN1QjR0aVlGS2RDSF9HU3JwT1V4NVIydVhLWEpKbnh6LVpaMC1YN2p4QU5nY3ktNTVrWFk2VEQyZDE3cTdiMmVCVktveHZlb2NoSVFISVQ4RElYMG44bXlHTmpQODNRN2hMUEJaV3V0ZGFZMF9WZVBuU2d0bzlDVFpMcjlxNElGdlVQVzBQTGhOemtLWl92eUJaa0lqLWRCcE16QlVPcGFBLWxzQXMzTGtHWC1WOUVsUkY2NzU4dy5MWm1fRE8yVW1tcGtqNE1xR29KZmhR"],"cache-control":["no-cache"],"channel-type":["MOBILE"],"client-correlation-id":["EAS-AND-raj"],"client-ip":["10.212.113.158"],"client_id":["0cdca3b725074d359841e1f9a067d29b"],"connection":["keep-alive"],"content-length":["2066"],"content-type":["application/json"],"country-code":["US"],"ct_request_id":["18198"],"customer-ip-address":["10.212.113.158"],"device-id":["6b7d17e26ef315a8"],"edge-context-id":["1e6da2dc-706c-4349-8e95-7190177c4578"],"endpoint_id":["6617a32ac9e24ef6b4eee3bb3686a134"],"forwarded":["for=10.207.33.20;proto=https;host=api-it.cloud.exampleone.com:443"],"host":["sicapis-ite.clouddqt.exampleone.com"],"user-agent":["rest-client/2.0.2 (darwin13.4.0 x86_64) ruby/2.2.2p95"],"x-apigw-app-id":["9d95ebde6aa64208a45b0c4b5bc6b944"],"x-apigw-key":["CapiOne-IT-INT-10.207.160.157"],"x-apigw-origin-client-id":["0cdca3b725074d359841e1f9a067d29b"],"x-apigw-resolved-upstream-env":["QA"],"x-apigw-upstream-backend-id":["9562ad1a-4cf8-4e4b-9e17-0e62741577c7"],"x-client-id":["0cdca3b725074d359841e1f9a067d29b"],"x-forwarded-cn":["rtmqa-client.xyz.exampleone.com"],"x-forwarded-for":["10.212.113.158, 10.212.113.110, 10.207.55.131, 10.207.33.20, 10.207.160.157"],"x-forwarded-host":["api-it.cloud.exampleone.com"],"x-forwarded-port":["443"],"x-forwarded-proto":["https"],"x-forwarded-server":["Mobile-e-qa-cr-mobile-ip-10-207-39-117.dqa.exampleone.com"],"x-message-id":["10.207.160.157-5cdc90cc-3a0a-4558-baa7-d5ead2d237db","10.207.160.157-5cdc90cc-3a0a-4558-baa7-d5ead2d237db"],"x-real-ip":["10.207.33.20"]},"userId":"ANONYMOUS","domainName":"defaultDomain","clientIP":"10.207.169.114","locale":"en_US","notNull":true,"messageId":"10.207.160.157-5cdc90cc-3a0a-4558-baa7-d5ead2d237db"},"args":{"customerLoginRequest":{"username":"LxVt+q2xu9IxB45k1y5ro2/GejqkajDqHcz0sNoCbPnyodEkfS0ZafmG/RsdWjBTZS8Uj4rtypsWnslbHnJaQUaWJcnpPFIGtIkrV9UsDBRNcypw+vtmnt1hSQR5V/V47J7WUNGj7CzVna+2qfOVrQLJeoEPt52XpjS/99h/Qp7RAjlstaPjFD0uvNIFt/pzSjckne7ZRyazCjVzI7cukZy9OQjGRHTQoVpQ1XnI5gXDsGyfzNnYL1kAIu4aUdQ6zj2ZdmDDIW2/2bWG1O5umMF7L17+O5jkgGtxqmlG6oHGD9qtRkkxQywmHkARzpaE0LfbWjGBdGKPlu5k2Enj8A==","authenticationMethod":"Password","authenticationMode":"AUTHENTICATE","device":{"authenticationDeviceId":"vszUyrQzY84IUm3RfIxPWdakysjEecl201McNBK3b3sK2B+zXAIhNUvaObWlc2DDtm1K81QlmoxkMI5UUuHCqkIPcaU5eWVbDu6MPHNEmV63kdNqSHi8ye8Mvmb5d7YhZyi2bC+6bS0bs6BhlYYPCPN/iW4GI6KNW8HF+CjIGWIqek/Cb5RHcHlCDfLeq/ODfPj1WOB83KCMqo7SfVjiEPWXgLmCBIY7OzodXLk9nInVEWf6jUZ8zNYRQEYYV+fYgPJvJP3PIA87wtU0x/MfGbt1Ctk8WdBVMWlPrX6WdOoBwTsgftZDCJ0HGfd7dGWaDDpQURphbB0A6xU8Yh7Jlg==","deviceModel":"iPad2","devicePlatform":"iPad","deviceType":"iPhone","deviceOperatingSystem":"ios","deviceOperatingSystemVersion":"7","deviceNickname":"PersonalIPad","appName":"Wallet","appVersion":"1.0.0","appEnvironment":"ios"},"riskAssessment":{"mobile":{"phoneNumber":"2134071411","mobileSdkInfo":"{ \"DeviceSystemVersion\" : \"9.0.2\", \"HardwareID\" : \"4D2DA09D666D4BB6ADCB42476F925C3C\", \"ScreenSize\" : \"375 x 667\", \"Languages\" : \"en-US\", \"MultitaskingSupported\" : true, \"DeviceModel\" : \"iPhone\", \"RSA_ApplicationKey\" : \"50A77F047BDCDA73EC511CD5337004C8\", \"WiFiMACAddress\" : \"4D2DA09D666D4BB6ADCB42476F925C3C\", \"TIMESTAMP\" : \"2015-10-09T19:35:52Z\", \"Emulator\" : 0, \"OtherId\" : \"4D2DA09D-666D-4BB6-ADCB-42476F925C3C\", \"OS_ID\" : \"00F6B812-4D96-4DFC-B6EF-A4B455017E78\", \"Compromised\" : 0, \"DeviceSystemName\" : \"iPhone OS\", \"DeviceName\" : \"iPhone (5)\", \"SDK_VERSION\" : \"2.0.1\" }","simId":"12122","universalDeviceIdentifier":"1D4031AB-0DD4-4699-952A-08688CFF"}},"signInPlatform":"EOS","sessionId":"EAS-AND-raj"}},"response":{"profileReferenceId":"9vX84mj85yu79fg/sHRhKmrFhN0Px+dk9EO8o+Ia8q5IUDx6CGaUHaXRhkE9KVEn","platforms":[{"platformCode":"360"},{"platformCode":"EASE"},{"platformCode":"EOS"}],"landingURL":[{"landingPlatformCode":"AVAILABLE_PRODUCTS","landingPlatformURL":"https://verified-it.exampleone.com/sic-ui/#/pathFinder"},{"landingPlatformCode":"360BANK","landingPlatformURL":"https://secure-qa2.int.exampleone360qa.com/myaccount/banking/postlogin"},{"landingPlatformCode":"CARD","landingPlatformURL":"https://cosqa4.xyz.exampleone.com/accounts/?initial_login=true"}],"loginStatus":"CHALLENGE","ssoId":"df2dae743fda82fb804e97dcd27eb2b3","mobileOnly":false}}}` ---
**Author:** ![shaileshmali](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@shaileshmali](https://discuss.elastic.co/u/shaileshmali)\ **Post date:** [August 25, 2017, 9:07pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005/9 "2017-08-25T21:07:58Z")
Thanks I tried \ toolbar option earlier as well . Trying it again. Please let me know message is visible now ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 27, 2017, 6:49pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005/10 "2017-08-27T18:49:43Z")
- You're using the wrong syntax for reading and writing fields. See [https://www.elastic.co/guide/en/logstash/current/event-api.html](https://www.elastic.co/guide/en/logstash/current/event-api.html). - `kv['key']` and `kv['value']` doesn't make sense as the objects in the array don't have any such keys (the keys are named landingPlatformCode and landingPlatformURL). - The `mutate { ... }` stuff doesn't belong inside the Ruby code. ---
**Author:** ![shaileshmali](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@shaileshmali](https://discuss.elastic.co/u/shaileshmali)\ **Post date:** [September 13, 2017, 4:11pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005/11 "2017-09-13T16:11:07Z")
This issue is resolved ruby { code =\> " require 'rubygems' require 'json' parray=[], p='', pcode='', pflag = 'NA', event, obj ='', obj = event.get('[EventStreamData][response][landingURL]') if (obj !=nil) obj.each do |pvar| p = pvar['landingPlatformCode'] parray.push(p) pcode = pcode + pvar['landingPlatformCode'] + ',' end end pcode = pcode.chop parray.each do |k| if (k=='Test' || k=='FIX' || k=='TestM' ) pflag = 'EASE' break end end puts pcode puts pflag event.set('pcode',pcode) event.set('pflag',pflag) " ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 11, 2017, 4:11pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005/12 "2017-10-11T16:11:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.