# Json filter with a problem

**URL:** <https://discuss.elastic.co/t/json-filter-with-a-problem/128269>\
**Category:** Logstash\
**Created:** [April 17, 2018, 12:51am UTC](https://discuss.elastic.co/t/json-filter-with-a-problem/128269 "2018-04-17T00:51:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![juandanielpujols](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juandanielpujols/32/30041_2.png) [@juandanielpujols](https://discuss.elastic.co/u/juandanielpujols)\
**Post date:** [April 17, 2018, 12:51am UTC](https://discuss.elastic.co/t/json-filter-with-a-problem/128269/1 "2018-04-17T00:51:41Z")

</div>

Hi, i´m new at this and i haven't been able to separate a json response from an api from the word "Ok" at the beginning. Please help. Below the response.

OK:  
[{ "EPOLeafNode.LastUpdate" : null, "EPOLeafNode.NodeName" : "xx.xx.xx.xx", "EPOComputerProperties.IPV6" : null, "EPOComputerProperties.IsPortable" : -1, "EPOComputerProperties.OSVersion" : "x", "EPOComputerProperties.UserName" : "z" }]

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [April 17, 2018, 4:52pm UTC](https://discuss.elastic.co/t/json-filter-with-a-problem/128269/2 "2018-04-17T16:52:29Z")

</div>

You will need to remove those leading characters before you decode the JSON.

Don't use the json codec, use the json filter instead but add the mutate filter with the gsub operation before the json filter.

Something like this:

```auto
input {
  generator {
    message => 'OK:
[{ "EPOLeafNode.LastUpdate" : null, "EPOLeafNode.NodeName" : "xx.xx.xx.xx", "EPOComputerProperties.IPV6" : null, "EPOComputerProperties.IsPortable" : -1, "EPOComputerProperties.OSVersion" : "x", "EPOComputerProperties.UserName" : "z" }]'
    count => 1
  }
}

filter {
  mutate {
    gsub => ["[message]", "^OK:\n\[(?<body>.+)]$", '\k<body>']
  }
  json {
    source => "[message]"
  }
}

output {
  stdout {
    codec => rubydebug {metadata => true}
  }
}

```

Gives:

```auto
{
    "EPOComputerProperties.IsPortable" => -1,
                            "sequence" => 0,
                          "@timestamp" => 2018-04-17T16:48:39.944Z,
                "EPOLeafNode.NodeName" => "xx.xx.xx.xx",
          "EPOComputerProperties.IPV6" => nil,
                            "@version" => "1",
                                "host" => "Elastics-MacBook-Pro.local",
      "EPOComputerProperties.UserName" => "z",
                             "message" => "{ \"EPOLeafNode.LastUpdate\" : null, \"EPOLeafNode.NodeName\" : \"xx.xx.xx.xx\", \"EPOComputerProperties.IPV6\" : null, \"EPOComputerProperties.IsPortable\" : -1, \"EPOComputerProperties.OSVersion\" : \"x\", \"EPOComputerProperties.UserName\" : \"z\" }",
              "EPOLeafNode.LastUpdate" => nil,
     "EPOComputerProperties.OSVersion" => "x"
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2018, 4:52pm UTC](https://discuss.elastic.co/t/json-filter-with-a-problem/128269/3 "2018-05-15T16:52:34Z")

</div>

Closed on May 15, 2018, 4:52pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.