# JSON形式のドキュメントを分割する方法

**URL:** <https://discuss.elastic.co/t/json/283391>\
**Category:** 日本語による質問・議論はこちら\
**Created:** [September 6, 2021, 2:27am UTC](https://discuss.elastic.co/t/json/283391 "2021-09-06T02:27:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![t-nakata](https://avatars.discourse-cdn.com/v4/letter/t/8491ac/32.png) [@t-nakata](https://discuss.elastic.co/u/t-nakata)\
**Post date:** [September 6, 2021, 2:27am UTC](https://discuss.elastic.co/t/json/283391/1 "2021-09-06T02:27:09Z")

</div>

以下のようなJSONファイルをlogstashのJSONフィルターを用いてElasticsearchに取り込みます

```auto
{
    "imageScanFindings": {
        "findings": [
            {
                "name": "CVE-2019-3462",
                "description": "Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-3462",
                "severity": "HIGH",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.6.3ubuntu0.1"
                    },
                    {
                        "key": "package_name",
                        "value": "apt"
                    }
                ]
            },
            {
                "name": "CVE-2018-16864",
                "description": "An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-16864",
                "severity": "HIGH",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "237-3ubuntu10.3"
                    },
                    {
                        "key": "package_name",
                        "value": "systemd"
                    }
                ]
            },
            {
                "name": "CVE-2018-16865",
                "description": "An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-16865",
                "severity": "HIGH",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "237-3ubuntu10.3"
                    },
                    {
                        "key": "package_name",
                        "value": "systemd"
                    }
                ]
            },
            {
                "name": "CVE-2016-1585",
                "description": "In all versions of AppArmor mount rules are accidentally widened when compiled.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-1585",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.12-4ubuntu5"
                    },
                    {
                        "key": "package_name",
                        "value": "apparmor"
                    }
                ]
            },
        ],
        "imageScanCompletedAt": 1572344124.0,
        "vulnerabilitySourceUpdatedAt": 1572309959.0,
        "findingSeverityCounts": {
            "HIGH": 3,
            "INFORMATIONAL": 15,
            "LOW": 75,
            "MEDIUM": 100
        }
    },
   "registryId": "629895769338",
    "repositoryName": "ecr-scan-sample",
    "imageId": {
        "imageDigest": "sha256:0e50bbb560068a88500da4fcd56264d3e0e386317efe2f3256f33baaba0ddf54",
        "imageTag": "latest"
    },
    "imageScanStatus": {
        "status": "COMPLETE",
        "description": "The scan was completed successfully."
    }
}

```

この場合、上記が1ドキュメントとしてElasticsearchに取り込まれることになる認識ですが、これをfinding以下を以下のような形で分割してそれぞれ別ドキュメント格納にすることは可能でしょうか。

Findings[  
出力結果１｛ ～ ｝,  
出力結果２｛ ～ ｝,・・・  
｝

---

<div class="post-metadata">

**Author:** ![tsgkdt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsgkdt/32/39151_2.png) [@tsgkdt](https://discuss.elastic.co/u/tsgkdt)\
**Post date:** [September 8, 2021, 12:03am UTC](https://discuss.elastic.co/t/json/283391/2 "2021-09-08T00:03:44Z")

</div>

Splitフィルターを使うとできるのでは？と思いました。

> **[Split filter plugin | Logstash Reference \[7.14\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html)**

配列をそれぞれのドキュメントに分割することができるかと。

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2021, 12:03am UTC](https://discuss.elastic.co/t/json/283391/3 "2021-10-06T00:03:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.