# JSON file parsing

**URL:** <https://discuss.elastic.co/t/json-file-parsing/94861>\
**Category:** Logstash\
**Created:** [July 27, 2017, 8:05pm UTC](https://discuss.elastic.co/t/json-file-parsing/94861 "2017-07-27T20:05:09Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![elaair](https://avatars.discourse-cdn.com/v4/letter/e/6f9a4e/32.png) [@elaair](https://discuss.elastic.co/u/elaair)\
**Post date:** [July 28, 2017, 5:29pm UTC](https://discuss.elastic.co/t/json-file-parsing/94861/4 "2017-07-28T17:29:40Z")

</div>

I got this to work based on a different posting from 2016 found here:

> [@Parse json Array input](https://discuss.elastic.co/t/parse-json-array-input/70194):
>
> I am retrieving some json data from a REST API ussing the http\_poller input pluging : http\_poller { urls =\> { "myurl" =\> "https://myAPI" } interval =\> 30 type =\> "myType" add\_field =\> { "tag" =\> "myTag" } } This returns a json formatted data : {"data\_from\_cache": false, "logs": [{"protocol": "PESIT", "processed": false }]} I need this data to be indexed in elasticsearch and I already prepared a mapping : { "my\_mapping" : { "properties" : { "proto…

I think some additional documentation around JSON would be helpful. I am open to help if someone from Elastic can assist as I am pretty dangerously new to this.

My config now looks like this:  
input {

```
    file {
            path => ["/Users/schroew/Documents/Scripts/NetskopeAPI/allNetSkopeEvents.json"]
            type => "netSkopeAPI"
            tags => "netSkopeAPI"
            codec => "json"
        }

```

} #close input

filter {  
if [path] == "/Users/schroew/Documents/Scripts/NetskopeAPI/allNetSkopeEvents.json" {

```
     split {
            field => "data"
    }

```

mutate {  
rename =\> { "[data][dst\_region]" =\> "dst\_region" }  
rename =\> { "[data][srcip]" =\> "srcip" }  
rename =\> { "[data][fromlogs]" =\> "fromlogs" }  
rename =\> { "[data][dstport]" =\> "dstport" }  
rename =\> { "[data][src\_zipcode]" =\> "src\_zipcode" }  
rename =\> { "[data][cci]" =\> "cci" }  
rename =\> { "[data][suppression\_start\_time]" =\> "suppression\_start\_time" }  
rename =\> { "[data][req\_cnt]" =\> "req\_cnt" }  
rename =\> { "[data][type]" =\> "type" }  
rename =\> { "[data][page\_duration]" =\> "page\_duration" }  
rename =\> { "[data][ccl]" =\> "ccl" }  
rename =\> { "[data][\_session\_begin]" =\> "session\_begin" }  
rename =\> { "[data][action]" =\> "action" }  
rename =\> { "[data][dstip]" =\> "dstip" }  
rename =\> { "[data][aggregated\_user]" =\> "aggregated\_user" }  
rename =\> { "[data][sfwder]" =\> "sfwder" }  
rename =\> { "[data][app]" =\> "app" }  
rename =\> { "[data][appcategory]" =\> "appcategory" }  
rename =\> { "[data][count]" =\> "count" }  
rename =\> { "[data][log\_file\_name]" =\> "log\_file\_name" }  
rename =\> { "[data][organization\_unit]" =\> "organization\_unit" }  
rename =\> { "[data][suppression\_end\_time]" =\> "suppression\_end\_time" }  
rename =\> { "[data][server\_bytes]" =\> "server\_bytes" }  
rename =\> { "[data][src\_country]" =\> "src\_country" }  
rename =\> { "[data][dst\_zipcode]" =\> "dst\_zipcode" }  
rename =\> { "[data][dst\_longitude]" =\> "dst\_longitude" }  
rename =\> { "[data][\_id]" =\> "id" }  
rename =\> { "[data][numbytes]" =\> "numbytes" }  
rename =\> { "[data][device]" =\> "device" }  
rename =\> { "[data][\_insertion\_epoch\_timestamp]" =\> "insertion\_epoch\_timestamp" }  
rename =\> { "[data][app\_session\_id]" =\> "app\_session\_id" }  
rename =\> { "[data][access\_method]" =\> "access\_method" }  
rename =\> { "[data][traffic\_type]" =\> "traffic\_type" }  
rename =\> { "[data][src\_longitude]" =\> "src\_longitude" }  
rename =\> { "[data][alert\_type]" =\> "alert\_type" }  
rename =\> { "[data][resp\_cnt]" =\> "resp\_cnt" }  
rename =\> { "[data][alert]" =\> "alert" }  
rename =\> { "[data][browser]" =\> "browser" }  
rename =\> { "[data][policy]" =\> "policy" }  
rename =\> { "[data][dst\_latitude]" =\> "dst\_latitude" }  
rename =\> { "[data][timestamp]" =\> "timestamp" }  
rename =\> { "[data][dst\_country]" =\> "dst\_country" }  
rename =\> { "[data][os]" =\> "os" }  
rename =\> { "[data][org]" =\> "org" }  
rename =\> { "[data][client\_bytes]" =\> "client\_bytes" }  
rename =\> { "[data][src\_region]" =\> "src\_region" }  
rename =\> { "[data][acked]" =\> "acked" }  
rename =\> { "[data][src\_location]" =\> "src\_location" }  
rename =\> { "[data][site]" =\> "site" }  
rename =\> { "[data][dst\_location]" =\> "dst\_location" }  
rename =\> { "[data][serial]" =\> "serial" }  
rename =\> { "[data][src\_latitude]" =\> "src\_latitude" }  
rename =\> { "[data][category]" =\> "category" }  
rename =\> { "[data][user]" =\> "user" }  
rename =\> { "[data][alert\_name]" =\> "alert\_name" }

convert =\> {"src\_latitude" =\> "float"}  
convert =\> {"dst\_latitude" =\> "float"}  
convert =\> {"src\_longitude" =\> "float"}  
convert =\> {"dst\_longitude" =\> "float"}  
}  
date {  
match =\> ["insertion\_epoch\_timestamp", "UNIX"]  
}

```
    } #close if

```

} # close filter

output {  
stdout {codec =\> rubydebug}  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
index =\> "netskope-28071138"  
}  
} #close output

---

_[View the full topic](https://discuss.elastic.co/t/json-file-parsing/94861)._