# Json parse
**URL:** https://discuss.elastic.co/t/json-parse/101701
**Category:** Logstash
**Created:** [September 25, 2017, 12:26pm UTC](https://discuss.elastic.co/t/json-parse/101701 "2017-09-25T12:26:18Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@neo\_levi](https://discuss.elastic.co/u/neo_levi)
#### Post date: [September 25, 2017, 12:26pm UTC](https://discuss.elastic.co/t/json-parse/101701/1 "2017-09-25T12:26:19Z")
hi all,
i want to parse my massage , it look like this below
so the columnName value will be the field name
and ColumnValue will be the value of the new field.
my code looks like ๐
input {
jdbc {
jdbc\_driver\_library =\> "/etc/logstash/drivers/sqljdbc\_6.0/enu/jre8/sqljdbc42.jar"
jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver"
jdbc\_connection\_string =\> "jdbc:sqlserver://XXX:1433;databasename=ELK"
jdbc\_user =\> "ELuser"
jdbc\_password =\> "PPPPPAa"
statement =\> " SELECT \* FROM [dbo].[\_tmp\_elk] WHERE json\_full\_text IS NOT NULL "
tags =\> ["pct"]
clean\_run =\> false
}
}
filter {
if "pct" in [tags]
{
json {
source =\> "json\_full\_text"
add\_field =\> {"[Columns][ColumnName]","%{[Columns][ColumnValue]}"}
```
}
```
date {
match =\> ["RequestOpenDate", "dd-MM-yyyy HH:mm"]
target =\> "RequestOpenDate"
}
date {
match =\> ["RequestCloseDate", "dd-MM-yyyy HH:mm"]
target =\> "RequestCloseDate"
}
date {
match =\> ["Actions\_InsertedDate", "dd-MM-yyyy HH:mm"]
target =\> "Actions\_InsertedDate"
}
mutate { remove\_field =\> ["json\_full\_text"] }
}
}
output {
if "pct" in [tags] {
elasticsearch {
user =\> elastic
password =\> nnuuuyt
hosts =\> ["[tlgdelkedb02.harel-office.com:9200](http://tlgdelkedb02.harel-office.com:9200)"]
index =\> "pct2-%{+YYYY.MM.dd}"
}
}
}
see the document below :
"\_index": "pro-2017.08.17",
"\_type": "logs",
"\_id": "AV60penuPiY1C8rIJQL9",
"\_score": 1,
"\_source": {
"ownerdepartment": "client",
"ownermobile": null,
"type": "logs",
"actions\_inserteddate": "2010-10-27T15:06:00.000Z",
"itemid": 93091,
"actions\_status": "yes",
"requesttype": "profile",
"@version": "1",
"requestessence": null,
"requestclosedate": "2010-10-27T15:06:00.000Z",
"requestcurrenthandler": "xxx",
"owner": "ืืชื ืงืืื",
"actions\_station": "sss",
"Columns": [
{
"ColumnID": 2520,
"ColumnName": "geter",
"ColumnValue": "ืmati glman",
"ColumnValueID": null
},
{
"ColumnID": 42083,
"ColumnName": "deparment",
"ColumnValue": "senior",
"ColumnValueID": null
},
{
"ColumnID": 2512,
"ColumnName": "phone",
"ColumnValue": "067547340",
"ColumnValueID": null
}
],
"requestparentitemid": 92853,
"requestopendate": "2010-10-20T11:03:00.000Z",
"actions\_notes": null,
"tags": [
"pct"
],
"ownerposition": "xxx",
"requestsubject": "yyyyy",
"actions\_id": 128528,
"@timestamp": "2017-08-17T10:55:16.875Z",
"ownerphone": 37547340,
"requeststatus": "close",
"actions\_insertedby": "yaniv hav"
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 25, 2017, 12:56pm UTC](https://discuss.elastic.co/t/json-parse/101701/2 "2017-09-25T12:56:30Z")
You need to write some Ruby code in a ruby filter to loop over all hashes in the `Columns` field and create fields for them. I'm pretty sure a solution to this has been posted here in the past.
---
### Author:  [@neo\_levi](https://discuss.elastic.co/u/neo_levi)
#### Post date: [September 25, 2017, 4:34pm UTC](https://discuss.elastic.co/t/json-parse/101701/3 "2017-09-25T16:34:55Z")
You can send a keywords or link, so I can find it?
---
### Author:  [@neo\_levi](https://discuss.elastic.co/u/neo_levi)
#### Post date: [September 26, 2017, 1:38pm UTC](https://discuss.elastic.co/t/json-parse/101701/4 "2017-09-26T13:38:40Z")
hi
i found somthing that you wrote in discuss
[Parse JSON array to flat JSON with filter, or alternative solution](https://discuss.elastic.co/t/parse-json-array-to-flat-json-with-filter-or-alternative-solution/54411)
I understood i can not use it like this any more,
can you help me by where to put set and get in this code?
ruby {
code =\> "
event['contextMap'].each { |kv|
event[kv['key']] = kv['value'] unless kv['value'].nil?
}
"
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 26, 2017, 1:40pm UTC](https://discuss.elastic.co/t/json-parse/101701/5 "2017-09-26T13:40:19Z")
```nohighlight
event.get('contextMap').each { |kv|
event.set(kv['key'], kv['value']) unless kv['value'].nil?
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 24, 2017, 1:40pm UTC](https://discuss.elastic.co/t/json-parse/101701/6 "2017-10-24T13:40:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.