# Jsons and logstash

**URL:** https://discuss.elastic.co/t/jsons-and-logstash/88222
**Category:** Logstash
**Created:** [June 5, 2017, 5:40am UTC](https://discuss.elastic.co/t/jsons-and-logstash/88222 "2017-06-05T05:40:33Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![coolshiva123](https://avatars.discourse-cdn.com/v4/letter/c/e36b37/32.png) [@coolshiva123](https://discuss.elastic.co/u/coolshiva123)
#### Post date: [June 5, 2017, 5:40am UTC](https://discuss.elastic.co/t/jsons-and-logstash/88222/1 "2017-06-05T05:40:33Z")

</div>

Hi Team,

I am having a json like this

[  
{  
item1:value  
item2:value  
item3:[value a,value b]  
}  
]

I am having filebeat sending the logs to logstash (and this is a multiline json having an array as well in key value pairs). I am trying to extract values by parsing json filters in logstash with out any sucesss. Can some one please help me to get a value, for example

item2:value

so that i can take this to elastic search and then time series graph thro Kibana  
I am having difficulty in

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 7, 2017, 6:03am UTC](https://discuss.elastic.co/t/jsons-and-logstash/88222/2 "2017-06-07T06:03:27Z")

</div>

I'd like to see

- a few lines of actual input (obfuscate values if you like but make sure the structure exactly matches reality),
- your configuration files, and
- an example event produced by Logstash (i.e. the effect your current configuration files have on the input).

---

<div class="post-metadata">

### Author: ![coolshiva123](https://avatars.discourse-cdn.com/v4/letter/c/e36b37/32.png) [@coolshiva123](https://discuss.elastic.co/u/coolshiva123)
#### Post date: [June 14, 2017, 10:54pm UTC](https://discuss.elastic.co/t/jsons-and-logstash/88222/3 "2017-06-14T22:54:01Z")

</div>

{  
"region\_name": “BLD\_EGD\_C\_VM01",  
"vmcount": 229,  
"vol\_count": 0,  
"vmsandvols\_count": 229,  
"no\_of\_networks": 2,  
"active\_ips": 276,  
"total\_ips\_configured": 961,  
"no\_of\_hypervisors": 1,  
"disk\_san\_free\_tb": 43.35330677032471,  
"disk\_san\_tb": 100.485595703125,  
"start\_time": 140617151754,  
"end\_time": 140617151920,  
"subnets\_identity": [  
"subnet\_1",  
"subnet\_2"  
],  
"subnet\_1": {  
"name": "EGD\_C\_19.195.16",  
"ipcount": 479  
},  
"subnet\_2": {  
"name": "EGD\_C\_19.195.18",  
"ipcount": 482  
},  
"hypervisor\_identity": [  
"h\_1"  
],  
"h\_1": {  
"id": 1,  
"name": "domain-c1403(Mountain02)",  
"vcpus": 312,  
"vcpus\_used": 773,  
"memory\_mb": 4217232,  
"memory\_used\_mb": 2422272,  
"disk\_discoverd\_gb": 102397,  
"disk\_used\_gb": 42443,  
"running\_vms": 229  
}  
}  
This is my subnet .. I am looking to plot graphs for example discovered\_disk\_gb vs disk\_used\_gb

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 15, 2017, 5:29am UTC](https://discuss.elastic.co/t/jsons-and-logstash/88222/4 "2017-06-15T05:29:42Z")

</div>

Please answer all my questions.

---

<div class="post-metadata">

### Author: ![coolshiva123](https://avatars.discourse-cdn.com/v4/letter/c/e36b37/32.png) [@coolshiva123](https://discuss.elastic.co/u/coolshiva123)
#### Post date: [June 17, 2017, 7:15am UTC](https://discuss.elastic.co/t/jsons-and-logstash/88222/5 "2017-06-17T07:15:53Z")

</div>

I have a simple config that doesnt parse json yet, i use a text filter (just to learn logstash), I have nt tried for the above mentioned json yet

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 15, 2017, 7:16am UTC](https://discuss.elastic.co/t/jsons-and-logstash/88222/6 "2017-07-15T07:16:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
