# JSON input field

**URL:** <https://discuss.elastic.co/t/json-input-field/217007>\
**Category:** Logstash\
**Created:** [January 29, 2020, 1:07pm UTC](https://discuss.elastic.co/t/json-input-field/217007 "2020-01-29T13:07:04Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mbt\_Mbt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mbt_mbt/32/56310_2.png) [@Mbt\_Mbt](https://discuss.elastic.co/u/Mbt_Mbt)\
**Post date:** [January 29, 2020, 1:07pm UTC](https://discuss.elastic.co/t/json-input-field/217007/1 "2020-01-29T13:07:04Z")

</div>

Good afternoon, I am trying to save the information contained in a field in independent fields for later analysis in kibana.

I have tried actions of the json target, source plugin ... but I don't get any positive results.

The format is as follows,

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/3/53b581d1e65697be356fd8e2d8489cf3993c5b7d.png)

Can somebody help me?

---

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [January 29, 2020, 2:38pm UTC](https://discuss.elastic.co/t/json-input-field/217007/2 "2020-01-29T14:38:53Z")

</div>

I'm not sure but if you just want to resolve this, you can run another json filter then use the event.EventData.CustomDataCollection.Rows column as source.

---

<div class="post-metadata">

**Author:** ![Mbt\_Mbt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mbt_mbt/32/56310_2.png) [@Mbt\_Mbt](https://discuss.elastic.co/u/Mbt_Mbt)\
**Post date:** [January 29, 2020, 2:59pm UTC](https://discuss.elastic.co/t/json-input-field/217007/3 "2020-01-29T14:59:46Z")

</div>

could you give more information please?

Thanks for your time

---

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [January 29, 2020, 3:13pm UTC](https://discuss.elastic.co/t/json-input-field/217007/4 "2020-01-29T15:13:23Z")

</div>

I think, it didnt parse the inner json due to it's an array. I suppose you are using logstash as u mentioned json plugin. Anyways, you can add either of these in the filter blocks.

```
 json {
 	source => "event.EventData.CustomDataCollection.Rows"
 }

```

or

```
 mutate {
 	add_field => { "phone" => "%{[event.EventData.CustomDataCollection.Rows][Phone][Value]}" }
	add_field => { "name" => "%{[event.EventData.CustomDataCollection.Rows][Name][Value]}" }
	add_field => { "lastname" => "%{[event.EventData.CustomDataCollection.Rows][LastName][Value]}" }
}

```

Then you can remove the event.EventData.CustomDataCollection.Rows after.

---

<div class="post-metadata">

**Author:** ![Mbt\_Mbt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mbt_mbt/32/56310_2.png) [@Mbt\_Mbt](https://discuss.elastic.co/u/Mbt_Mbt)\
**Post date:** [January 29, 2020, 4:55pm UTC](https://discuss.elastic.co/t/json-input-field/217007/5 "2020-01-29T16:55:48Z")

</div>

> [@inhinyera16](#):
>
> json { source =\> "event.EventData.CustomDataCollection.Rows" }

Thank you very much for your time inhinyera16 but it has not worked.

Any idea how I can pass the information to independent fields?

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [January 29, 2020, 6:36pm UTC](https://discuss.elastic.co/t/json-input-field/217007/6 "2020-01-29T18:36:33Z")

</div>

source =\> "[event][EventData][CustomDataCollections][Rows]"

---

<div class="post-metadata">

**Author:** ![Mbt\_Mbt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mbt_mbt/32/56310_2.png) [@Mbt\_Mbt](https://discuss.elastic.co/u/Mbt_Mbt)\
**Post date:** [January 29, 2020, 10:24pm UTC](https://discuss.elastic.co/t/json-input-field/217007/7 "2020-01-29T22:24:18Z")

</div>

Thank you very much for your help and time but I have not been able to extract the fields using the advice received.

Any other idea?

Many thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 30, 2020, 1:15am UTC](https://discuss.elastic.co/t/json-input-field/217007/8 "2020-01-30T01:15:09Z")

</div>

Add

```
output { stdout { codec => rubydebug } }

```

and show us what an event looks like. That contains more information than the JSON tab in Kibana.

---

<div class="post-metadata">

**Author:** ![Mbt\_Mbt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mbt_mbt/32/56310_2.png) [@Mbt\_Mbt](https://discuss.elastic.co/u/Mbt_Mbt)\
**Post date:** [January 30, 2020, 7:51am UTC](https://discuss.elastic.co/t/json-input-field/217007/9 "2020-01-30T07:51:14Z")

</div>

> [@Badger](#):
>
> stdout { codec =\> rubydebug }

Hello Badger,

Thanks for your healp,

{  
"\_index": "bplogs",  
"\_type": "\_doc",  
"\_id": "dx1t9W8BQpprR2SqZxxM",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"headers": {  
"http\_version": "HTTP/1.1",  
"http\_accept": null,  
"accept\_encoding": "gzip,deflate",  
"connection": "Keep-Alive",  
"http\_host": "localhost:5044",  
"http\_user\_agent": "Manticore 0.6.4",  
"content\_type": "application/json",  
"request\_path": "/",  
"request\_method": "PUT",  
"content\_length": "1010"  
},  
"eventdata": "{"EventData":{"CustomDataCollection":{"Rows":[{"Name":{"Value":"Robin"},"LastName":{"Value":"Hood"},"Phone":{"Value":"967778875"}}]},"SessionNumber":15,"StageID":"180fabc4-fbc8-422d-a5d0-e0270f4e42b1","StageName":"Data Gateways::Send Custom Data","StageType":2,"StartDate":"2020-01-30T08:49:43.4891218+01:00","ProcessName":"DataGateway","PageName":"Main Page","ObjectName":"Data Gateways","actionName":"Send Custom Data"},"EventType":3}",  
"@version": "1",  
"@timestamp": "2020-01-30T07:49:45.118Z",  
"event": {  
"EventType": 3,  
"EventData": {  
"CustomDataCollection": {  
"Rows": [  
{  
"Name": {  
"Value": "Robin"  
},  
"Phone": {  
"Value": "967778875"  
},  
"LastName": {  
"Value": "Hood"  
}  
}  
]  
},  
"SessionNumber": 15,  
"StageType": 2,  
"ProcessName": "DataGateway",  
"StageName": "Data Gateways::Send Custom Data",  
"PageName": "Main Page",  
"ObjectName": "Data Gateways",  
"StartDate": "2020-01-30T08:49:43.4891218+01:00",  
"StageID": "180fabc4-fbc8-422d-a5d0-e0270f4e42b1",  
"actionName": "Send Custom Data"  
}  
}  
},  
"fields": {  
"event.EventData.StartDate": [  
"2020-01-30T07:49:43.489Z"  
],  
"@timestamp": [  
"2020-01-30T07:49:45.118Z"  
]  
},  
"sort": [  
1580370585118  
]  
}{  
"\_index": "bplogs",  
"\_type": "\_doc",  
"\_id": "dx1t9W8BQpprR2SqZxxM",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"headers": {  
"http\_version": "HTTP/1.1",  
"http\_accept": null,  
"accept\_encoding": "gzip,deflate",  
"connection": "Keep-Alive",  
"http\_host": "localhost:5044",  
"http\_user\_agent": "Manticore 0.6.4",  
"content\_type": "application/json",  
"request\_path": "/",  
"request\_method": "PUT",  
"content\_length": "1010"  
},  
"eventdata": "{"EventData":{"CustomDataCollection":{"Rows":[{"Name":{"Value":"Robin"},"LastName":{"Value":"Hood"},"Phone":{"Value":"967778875"}}]},"SessionNumber":15,"StageID":"180fabc4-fbc8-422d-a5d0-e0270f4e42b1","StageName":"Data Gateways::Send Custom Data","StageType":2,"StartDate":"2020-01-30T08:49:43.4891218+01:00","ProcessName":"DataGateway","PageName":"Main Page","ObjectName":"Data Gateways","actionName":"Send Custom Data"},"EventType":3}",  
"@version": "1",  
"@timestamp": "2020-01-30T07:49:45.118Z",  
"event": {  
"EventType": 3,  
"EventData": {  
"CustomDataCollection": {  
"Rows": [  
{  
"Name": {  
"Value": "Robin"  
},  
"Phone": {  
"Value": "967778875"  
},  
"LastName": {  
"Value": "Hood"  
}  
}  
]  
},  
"SessionNumber": 15,  
"StageType": 2,  
"ProcessName": "DataGateway",  
"StageName": "Data Gateways::Send Custom Data",  
"PageName": "Main Page",  
"ObjectName": "Data Gateways",  
"StartDate": "2020-01-30T08:49:43.4891218+01:00",  
"StageID": "180fabc4-fbc8-422d-a5d0-e0270f4e42b1",  
"actionName": "Send Custom Data"  
}  
}  
},  
"fields": {  
"event.EventData.StartDate": [  
"2020-01-30T07:49:43.489Z"  
],  
"@timestamp": [  
"2020-01-30T07:49:45.118Z"  
]  
},  
"sort": [  
1580370585118  
]  
}

Thanks

---

<div class="post-metadata">

**Author:** ![Mbt\_Mbt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mbt_mbt/32/56310_2.png) [@Mbt\_Mbt](https://discuss.elastic.co/u/Mbt_Mbt)\
**Post date:** [January 30, 2020, 9:44am UTC](https://discuss.elastic.co/t/json-input-field/217007/10 "2020-01-30T09:44:24Z")

</div>

tried adding this code

ruby {  
code =\> '  
event.get("[event][EventData][CustomDataCollection][Rows]").each { |x|  
k = x  
v = x["Value"]  
if ["Phone", "Name","LastName"].include? k  
event.set(k, v)  
end  
}'  
}

but i doesnt work

---

<div class="post-metadata">

**Author:** ![Mbt\_Mbt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mbt_mbt/32/56310_2.png) [@Mbt\_Mbt](https://discuss.elastic.co/u/Mbt_Mbt)\
**Post date:** [January 30, 2020, 10:43am UTC](https://discuss.elastic.co/t/json-input-field/217007/11 "2020-01-30T10:43:28Z")

</div>

tried

json{  
source =\> "eventdata"  
target =\> "parsedJson"  
remove\_field=\>["eventdata"]  
}

mutate {  
add\_field =\> {  
"firstname" =\> "%{[parsedJson][EventData][CustomDataCollection][Rows][Name]}"  
}  
}

too and still not getting the expected results

thanks

---

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [January 30, 2020, 11:21am UTC](https://discuss.elastic.co/t/json-input-field/217007/12 "2020-01-30T11:21:42Z")

</div>

Ok so here you go, this works on my end

```
input {
	file {
		path => "/tmpBIS/ror/elastic_env/logstash-6.7.1/log"
		start_position => "beginning"
 		sincedb_path => "/dev/null"
	}
}

filter {

	json {
		source => "message"
	}

	mutate {
		add_field => { "[EventData][CustomDataCollection_Name]" => "%{[EventData][CustomDataCollection][Rows][0][Name][Value]}" }
		add_field => { "[EventData][CustomDataCollection_LastName]" => "%{[EventData][CustomDataCollection][Rows][0][LastName][Value]}" }
		add_field => { "[EventData][CustomDataCollection_Phone]" => "%{[EventData][CustomDataCollection][Rows][0][Phone][Value]}" }
	}

	mutate {
		remove_field => ["message","host","@version","path","@timestamp","[EventData][CustomDataCollection]" ]
	}
}
output {
	stdout {codec=> rubydebug}
}

```

![image](https://us1.discourse-cdn.com/elastic/original/3X/2/0/2041dc8763328b70c99c8bd9ec9125954bb499d7.png)

---

<div class="post-metadata">

**Author:** ![Mbt\_Mbt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mbt_mbt/32/56310_2.png) [@Mbt\_Mbt](https://discuss.elastic.co/u/Mbt_Mbt)\
**Post date:** [January 30, 2020, 12:52pm UTC](https://discuss.elastic.co/t/json-input-field/217007/13 "2020-01-30T12:52:19Z")

</div>

inhinyera16,

Thank you very much for your help,

It's a pleasure that there are people like you.

---

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [January 30, 2020, 1:23pm UTC](https://discuss.elastic.co/t/json-input-field/217007/14 "2020-01-30T13:23:32Z")

</div>

thanks @Mbt_Mbt!

Ps: Please mark as "Solution" if you think this helps 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2020, 1:23pm UTC](https://discuss.elastic.co/t/json-input-field/217007/15 "2020-02-27T13:23:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.