# JSON response parsing at attribute level **URL:** \ **Category:** Logstash\ **Created:** [August 3, 2020, 12:03pm UTC](https://discuss.elastic.co/t/json-response-parsing-at-attribute-level/243552 "2020-08-03T12:03:26Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Puneeth\_S\_B\_Gowda1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/puneeth_s_b_gowda1/32/68544_2.png) [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Post date:** [August 3, 2020, 12:03pm UTC](https://discuss.elastic.co/t/json-response-parsing-at-attribute-level/243552/1 "2020-08-03T12:03:27Z")
Hi, my logstash configuration for moving JSON response isinput { beats { port =\> 5044 } } filter {mutate { split =\> { "message" =\> "@$@" }} mutate { add\_field =\> { "response" =\> "%{[message][7]}" "channel\_typ" =\> "%{[message][2]}"}} mutate {remove\_field =\> ["message","@version"]}}output { elasticsearch { hosts =\> ["[http://10.201.30.181:9200](http://10.201.30.181:9200/)"] index =\> "hotelhub2" } }Output in kibana like thisWe want to parse attribute value into separate columns dynamically ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/0/40309ef60458aab9842964d3ab87127d62851c1c.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 3, 2020, 4:39pm UTC](https://discuss.elastic.co/t/json-response-parsing-at-attribute-level/243552/2 "2020-08-03T16:39:23Z")
If it is valid JSON then use a json filter ``` json { source => "response" } ``` ---
**Author:** ![Puneeth\_S\_B\_Gowda1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/puneeth_s_b_gowda1/32/68544_2.png) [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Post date:** [August 3, 2020, 6:23pm UTC](https://discuss.elastic.co/t/json-response-parsing-at-attribute-level/243552/3 "2020-08-03T18:23:13Z")
Now I have one more challenging my data source is with multiple data format json And xml so how do I add multiple filter? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 3, 2020, 7:29pm UTC](https://discuss.elastic.co/t/json-response-parsing-at-attribute-level/243552/4 "2020-08-03T19:29:49Z")
You could just pass the response to both the xml and json filters and let one fail. You could test the first character of the response. ``` if [response] =~ /^{/ { json { ... } } else { xml { ... } } ``` or if there is some other field that tells you what format the response is in (e.g. a mime type somewhere) then test that. ---
**Author:** ![Puneeth\_S\_B\_Gowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/puneeth_s_b_gowda/32/68216_2.png) [@Puneeth\_S\_B\_Gowda](https://discuss.elastic.co/u/Puneeth_S_B_Gowda)\ **Post date:** [August 4, 2020, 7:22am UTC](https://discuss.elastic.co/t/json-response-parsing-at-attribute-level/243552/5 "2020-08-04T07:22:42Z")
after pasrsing json there array value like this ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/1/01b041d7588ac80319ac1dfe50ce9db6e07aef37.png) Each value should move to new rows how do we do that the way above spread sheet showing under expected Below is my conf input { beats { port =\> 5044 } } filter { mutate { split =\> { "message" =\> "@$@" }} mutate { add\_field =\> { "response" =\> "%{[message][7]}" "channel\_typ" =\> "%{[message][2]}"}} mutate {remove\_field =\> ["message","@version"]} json { source =\> "response" } mutate {remove\_field =\> ["response"]} ``` } ``` output { elasticsearch { hosts =\> ["[http://10.201.30.181:9200](http://10.201.30.181:9200)"] index =\> "hotelhub2" } } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 4, 2020, 4:28pm UTC](https://discuss.elastic.co/t/json-response-parsing-at-attribute-level/243552/6 "2020-08-04T16:28:41Z")
Can you show as either JSON or rubydebug the current structure of the data as well as the structure that you want it to have? ---
**Author:** ![Puneeth\_S\_B\_Gowda1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/puneeth_s_b_gowda1/32/68544_2.png) [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Post date:** [August 4, 2020, 4:46pm UTC](https://discuss.elastic.co/t/json-response-parsing-at-attribute-level/243552/7 "2020-08-04T16:46:37Z")
Already added image above please refer that current result and expected result ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 4, 2020, 5:47pm UTC](https://discuss.elastic.co/t/json-response-parsing-at-attribute-level/243552/8 "2020-08-04T17:47:11Z")
A screenshot of a spreadsheet tells me nothing about the data structure. ---
**Author:** ![Puneeth\_S\_B\_Gowda1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/puneeth_s_b_gowda1/32/68544_2.png) [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Post date:** [August 7, 2020, 12:07pm UTC](https://discuss.elastic.co/t/json-response-parsing-at-attribute-level/243552/9 "2020-08-07T12:07:07Z")
{ "meta":{}, "result":[ { "cvc\_required":false, "checkin":"2020-07-25", "cc\_required":true, "policies":, "checkout":"2020-07-26", "block":[ { "block\_id":"9825107\_125413879\_1\_42\_0", "name":"Standard Double Room - single occupancy - Non-refundable", "payment\_terms":{ "cancellation\_description":"Please note, if cancelled, modified or in case of no-show, the total price of the reservation will be charged.", "name":"Non-refundable – Prepayment needed", "prepayment\_description":"You will be charged a prepayment of the total price at any time." }, "free\_wifi":false, "room\_description":"Rooms are 30 square metres.", "room\_surface\_in\_feet2":322.92, "refundable":false, "breakfast\_included":false, "min\_price":{ "currency":"USD", "price":100.26, "extra\_charges\_breakdown":{ "extra\_charge":[ { "amount":5.0, "excluded":false, "name":"Towel charge", "type":"SERVICECHARGE", "charge\_amount":5.0, "charge\_price\_mode":3, "currency":"USD" ---
**Author:** ![Puneeth\_S\_B\_Gowda1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/puneeth_s_b_gowda1/32/68544_2.png) [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Post date:** [August 7, 2020, 12:09pm UTC](https://discuss.elastic.co/t/json-response-parsing-at-attribute-level/243552/10 "2020-08-07T12:09:27Z")
Above one is my JSON all the details need to show in kibana as table format instead of JSON format as bellow in the new index | cvc\_required | checkin | block\_id | | --- | --- | --- | | FALSE | 25-07-20 | 9825107\_125413879\_1\_42\_0 | | FALSE | 25-07-20 | 9825107\_125413879\_1\_42\_0 | | FALSE | 25-07-20 | 9825107\_125413879\_1\_42\_0 | | FALSE | 25-07-20 | 9825107\_125413879\_1\_42\_0 | ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 4, 2020, 12:09pm UTC](https://discuss.elastic.co/t/json-response-parsing-at-attribute-level/243552/11 "2020-09-04T12:09:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.