# Json Transform in Logstash

**URL:** <https://discuss.elastic.co/t/json-transform-in-logstash/198698>\
**Category:** Logstash\
**Created:** [September 9, 2019, 1:57pm UTC](https://discuss.elastic.co/t/json-transform-in-logstash/198698 "2019-09-09T13:57:07Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Siddharth86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siddharth86/32/53853_2.png) [@Siddharth86](https://discuss.elastic.co/u/Siddharth86)\
**Post date:** [September 9, 2019, 1:57pm UTC](https://discuss.elastic.co/t/json-transform-in-logstash/198698/1 "2019-09-09T13:57:07Z")

</div>

I have a json like this  
{  
"consumer": {  
"created\_at": 1566912618154,  
"username": "dummyapp",  
"id": "079c3e6d-ca35-464b-8596-b2ace5e60481"  
},  
"service": {  
"created\_at": 1567173649,  
"connect\_timeout": 60000,  
"protocol": "https",  
"read\_timeout": 60000,  
"port": 9090,  
"updated\_at": 1567173649,  
"retries": 1,  
"write\_timeout": 60000  
},  
"request": {  
"querystring": {},  
"size": "361",  
"headers": {  
"cache-control": "no-cache",  
"content-length": "0",  
"postman-token": "fb9e10e4-2f66-4126-beec-d5c1f7c06bf7",  
"user-agent": "PostmanRuntime/7.15.0",  
"accept": "_/_",  
"accept-encoding": "gzip, deflate",  
"connection": "keep-alive"  
},  
"method": "POST"  
}  
}

I want this to be transformed as

```
{
"Title":"Sample"
"consumer": {
    "created_at": 1566912618154,
    "username": "dummyapp"
},
"service": {
    "created_at": 1567173649,
    "connect_timeout": 60000
},
"request": {
    "querystring": {},
    "headers": {
        "user-agent": "PostmanRuntime\/7.15.0"
    }
    "method": "POST"
}

```

}

I am using below filter

input {  
file {  
path =\> "Path\_to\_Log\test.log"  
start\_position =\> "beginning"  
type =\> "json"  
}  
}

filter {  
mutate {  
add\_field =\> {  
"Title" =\> "Sample"  
}  
remove\_field =\>[consumer][id]  
...Some other changes  
}  
}

output {  
file {  
path =\> "Output\_Path\Output.log"  
}  
}

But somehow remove\_field is not working.How do i get expected output.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 9, 2019, 2:40pm UTC](https://discuss.elastic.co/t/json-transform-in-logstash/198698/2 "2019-09-09T14:40:17Z")

</div>

You need to add either a json codec on the input, or a json filter.

---

<div class="post-metadata">

**Author:** ![Siddharth86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siddharth86/32/53853_2.png) [@Siddharth86](https://discuss.elastic.co/u/Siddharth86)\
**Post date:** [September 10, 2019, 9:05am UTC](https://discuss.elastic.co/t/json-transform-in-logstash/198698/3 "2019-09-10T09:05:27Z")

</div>

Yes i added json codec to input filter,it worked. How will i tranform input json to specific output json format.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 10, 2019, 11:58am UTC](https://discuss.elastic.co/t/json-transform-in-logstash/198698/4 "2019-09-10T11:58:17Z")

</div>

You can use a json\_lines codec on the output.

---

<div class="post-metadata">

**Author:** ![Siddharth86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siddharth86/32/53853_2.png) [@Siddharth86](https://discuss.elastic.co/u/Siddharth86)\
**Post date:** [September 11, 2019, 10:34am UTC](https://discuss.elastic.co/t/json-transform-in-logstash/198698/5 "2019-09-11T10:34:13Z")

</div>

I removed fields but i get output as

```
 "consumer": [["created_at", 1566912618154], ["id", "07912445-ca35-464b-8596-b2ace5e60481"], ["username", "dummyapp"], 
"{\"created_at\":1566912618154,\"id\":\"07912445-ca35-464b-8596-b2ace5e60481\",\"username\":\"dummyapp\"}"],
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2019, 10:34am UTC](https://discuss.elastic.co/t/json-transform-in-logstash/198698/6 "2019-10-09T10:34:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.