# JSON Parse an already parsed field

**URL:** <https://discuss.elastic.co/t/json-parse-an-already-parsed-field/147006>\
**Category:** Logstash\
**Created:** [September 3, 2018, 3:54am UTC](https://discuss.elastic.co/t/json-parse-an-already-parsed-field/147006 "2018-09-03T03:54:25Z")\
**Posts on this page:** 1\
**Showing post:** 10

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [September 4, 2018, 5:33am UTC](https://discuss.elastic.co/t/json-parse-an-already-parsed-field/147006/10 "2018-09-04T05:33:59Z")

</div>

Hi magnus,

I was able to parse the json object as seperate fields using the ruby filter, but i am not sure how to join the fields. Could you provide some pointers?

Not sure if I should post it here or not. I have posted it in the original thread that I had created.

> [@JSON array parsing in Logstash using the ruby filter](https://discuss.elastic.co/t/json-array-parsing-in-logstash-using-the-ruby-filter/146829/5):
>
> This is getting parsed properly according to Logstash, but it is getting indexed as a nested object in Elasticsearch. As they are not well supported in Kibana, I hope to create a flat structured array using the ruby filter. Here is my config: input { file { path =\> "/home/fire.log" sincedb\_path =\> "/dev/null" start\_position =\> "beginning" codec =\> json } } filter { ruby { code =\> " message\_array = event.get('[alert][explanation][cnc-services][cnc-service]') …

---

_[View the full topic](https://discuss.elastic.co/t/json-parse-an-already-parsed-field/147006)._