# JSON nested field loosing formating when referenced in add\_field **URL:** \ **Category:** Logstash\ **Created:** [September 11, 2018, 12:59pm UTC](https://discuss.elastic.co/t/json-nested-field-loosing-formating-when-referenced-in-add-field/148126 "2018-09-11T12:59:25Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![marc1](https://avatars.discourse-cdn.com/v4/letter/m/49beb7/32.png) [@marc1](https://discuss.elastic.co/u/marc1)\ **Post date:** [September 11, 2018, 12:59pm UTC](https://discuss.elastic.co/t/json-nested-field-loosing-formating-when-referenced-in-add-field/148126/1 "2018-09-11T12:59:25Z")
Hello, we have a use case where we would like to ingest specific JSON formatted messages into elasticsearch as well as convert the content of the input message into a new output JSON format and write it out to a Kafka topic. The ingestion into elasticsearch as well as writing the output to the Kafka topic is functional. What I am having difficulty with is the conversion from one JSON schema to the other as I have a nested JSON field. I am currently writing out the new JSON message manually in the pipeline by mutating and adding a new field. Here is an example of the input message: ```auto { "sourceSystemId" : "SystemABC", "externalAlarmId" : "11082807", "alarmRaisedTime" : "2018-01-01T19:41:01Z", "alarmType" : "QueueStatus", "alarmedObject" : { "id": "DeviceABC", "resource" : { "id": "DeviceABC", "name": "DeviceABC", "category": "NODE", "characteristic" : [ { "name": "NodeAlias", "value": "192.168.1.1" }, { "name": "AlertKey", "value": "c3-1-1-2" }, { "name": "deviceType", "value": "router" } ] } }, "perceivedSeverity" : "MINOR", } ``` By using the JSON codec on the input all fields are extracted and usable with the exception of the nested JSON which creates has an array called: ```auto [alarmedObject][resource][characteristic] ``` When I construct my new JSON message utilizing this array field the output is stripped of the quotes and colon. Here is my sample config as well as actual output and desired output for reference. ```auto input { udp { tags => ["udp"] port => 50000 codec => json } } filter { mutate { add_field => {test_message_3 => '{"additionalAlarmInfo":[%{[alarmedObject][resource][characteristic]}]}'} } ``` Current OUTPUT when referencing the contents of nested JSON field. We see that for some reason an "=" sign is added to the content. ```auto { "additionalAlarmInfo":[ "{name=NodeAlias, value=192.168.1.1},{name=AlertKey, value=c3-1-1-2},{name=deviceType, value=router}" ] } ``` Desired OUTPUT which is JSON compliant. ```auto { "additionalAlarmInfo":[ { "name": "NodeAlias", "value": "192.168.1.1" }, { "name": "AlertKey", "value": "c3-1-1-2" }, { "name": "deviceType", "value": "router" } ] } ``` My question is how do I include the as JSON formatted content of the array into a new field? Am I calling the array incorrectly with the following in my new message? ```auto '{"additionalAlarmInfo":[%{[alarmedObject][resource][characteristic]}]}' ``` I hope this makes sense. Any direction from the community that could be provided would be greatly appreciated. Thank you. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 12, 2018, 5:11pm UTC](https://discuss.elastic.co/t/json-nested-field-loosing-formating-when-referenced-in-add-field/148126/2 "2018-09-12T17:11:07Z")
I don't think you can construct what you want using the regular Logstash configuration language. You'll have to use a ruby filter. ---
**Author:** ![marc1](https://avatars.discourse-cdn.com/v4/letter/m/49beb7/32.png) [@marc1](https://discuss.elastic.co/u/marc1)\ **Post date:** [September 13, 2018, 11:18am UTC](https://discuss.elastic.co/t/json-nested-field-loosing-formating-when-referenced-in-add-field/148126/3 "2018-09-13T11:18:08Z")
Hello, Thank you for the reply and input. After much trial and error I found the json\_encode plugin and was able to use it as desired. By using: ```auto json_encode { source => "[alarmedObject][resource][characteristic]" target => "encoded_additional_information" } ``` The field `[alarmedObject][resource][characteristic]` is formatted to the following array: ```auto [{"name":"NodeAlias","value":"192.168.135.95"},{"name":"AlertKey","value":"c3-1-1-2"},{"name":"deviceType","value":"AMAS"},{"name":"Count","value":"10058"}] ``` Which is the proper syntax I am looking for. I then reference the newly encoded field by using `%{encoded_additional_information}`. The end JSON message with the array looks like the following which is desirable. ```auto "faultFields":{ "eventSeverity":"MINOR", "alarmCondition":"UNACKNOWLEDGED", "faultFieldsVersion":"4.0", "specificProblem":"EventProcessor : QueueSize: 0 (Min: 0 Max: 0) DeltaQueue: 0", "alarmAdditionalInformation":[ [ { "name":"NodeAlias", "value":"192.168.1.1" }, { "name":"AlertKey", "value":"c3-1-1-2" }, { "name":"Count", "value":"10058" } ] ] } ``` Thanks again. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 11, 2018, 11:18am UTC](https://discuss.elastic.co/t/json-nested-field-loosing-formating-when-referenced-in-add-field/148126/4 "2018-10-11T11:18:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.