# Kvpairs where one of the values is a JSON structure **URL:** \ **Category:** Logstash\ **Created:** [August 24, 2015, 9:54pm UTC](https://discuss.elastic.co/t/kvpairs-where-one-of-the-values-is-a-json-structure/27980 "2015-08-24T21:54:17Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![robynkoz](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@robynkoz](https://discuss.elastic.co/u/robynkoz)\ **Post date:** [August 24, 2015, 9:54pm UTC](https://discuss.elastic.co/t/kvpairs-where-one-of-the-values-is-a-json-structure/27980/1 "2015-08-24T21:54:17Z")
I have a log that I am parsing using grok and kv: ``` filter { grok { match => {"message" => "msg=%{WORD:action} %{GREEDYDATA:kvpairs}" } } kv { source => "kvpairs" remove_field => ["kvpairs"] } } ``` One of the values in my kvpairs is structured JSON data that I want to interpret as additional key/value pairs. How can I do this? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 24, 2015, 10:50pm UTC](https://discuss.elastic.co/t/kvpairs-where-one-of-the-values-is-a-json-structure/27980/2 "2015-08-24T22:50:26Z")
You will probably want to do another grok + match. ---
**Author:** ![robynkoz](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@robynkoz](https://discuss.elastic.co/u/robynkoz)\ **Post date:** [August 24, 2015, 11:07pm UTC](https://discuss.elastic.co/t/kvpairs-where-one-of-the-values-is-a-json-structure/27980/3 "2015-08-24T23:07:46Z")
I'm very new to logstash -- could you give me a hint as to how to do that. Would I add another grok filter after the kv filter? If my key is "jsondata" what would that look like. Thanks in advance! (If there is good documentation with examples that you could point me to, I'd be happy to RTFM -- but I'm finding just the basic documentation that defines the format for each of the filters a little inadequate for me to get rolling with.) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 24, 2015, 11:09pm UTC](https://discuss.elastic.co/t/kvpairs-where-one-of-the-values-is-a-json-structure/27980/4 "2015-08-24T23:09:52Z")
Yeah exactly! It's exactly the same as what you have but do it on the other KV pair you want to split. ---
**Author:** ![robynkoz](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@robynkoz](https://discuss.elastic.co/u/robynkoz)\ **Post date:** [August 25, 2015, 2:46am UTC](https://discuss.elastic.co/t/kvpairs-where-one-of-the-values-is-a-json-structure/27980/5 "2015-08-25T02:46:50Z")
Thanks! I tried this and it almost worked but it looks like kv truncated my json string, so I got a json parse error: ``` filter { grok { match => {"message" => "msg=%{WORD:action} %{GREEDYDATA:kvpairs}" } } kv { source => "kvpairs" remove_field => ["kvpairs"] } grok { match => {"jsondata" => "%{GREEDYDATA:jsonpairs}" } } json { source => "jsonpairs" remove_field => ["jsonpairs"] } } ``` Is there a limit on the length of the value in a kv pair? If so, how can I increase it? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 25, 2015, 2:54am UTC](https://discuss.elastic.co/t/kvpairs-where-one-of-the-values-is-a-json-structure/27980/6 "2015-08-25T02:54:52Z")
I don't think so, but what was the error you got? ---
**Author:** ![robynkoz](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@robynkoz](https://discuss.elastic.co/u/robynkoz)\ **Post date:** [August 25, 2015, 3:15am UTC](https://discuss.elastic.co/t/kvpairs-where-one-of-the-values-is-a-json-structure/27980/7 "2015-08-25T03:15:58Z")
I'm looking at the log entry in Kibana and I see a > tags: \_jsonparsefailure entry in the log And I can see that the jsonpairs string is truncated (as is jsondata). I can see the full json string in the message value. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 25, 2015, 6:18am UTC](https://discuss.elastic.co/t/kvpairs-where-one-of-the-values-is-a-json-structure/27980/8 "2015-08-25T06:18:52Z")
``` grok { match => {"jsondata" => "%{GREEDYDATA:jsonpairs}" } } ``` This filter serves no purpose. It's just a convoluted way of copying a field to another. Where did the JSON message get truncated? Can you produce a minimal reproducible example? Did it by any chance get truncated near an equals sign or something else that has a special meaning to kv? ---
**Author:** ![robynkoz](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@robynkoz](https://discuss.elastic.co/u/robynkoz)\ **Post date:** [August 25, 2015, 6:23am UTC](https://discuss.elastic.co/t/kvpairs-where-one-of-the-values-is-a-json-structure/27980/9 "2015-08-25T06:23:45Z")
You're right about the grok of course -- I realized afterwards that jsondata and jsonpairs would always be identical. The truncation happened right in the middle of a quoted string, not near any special characters, but right after the word "Error" in case that is significant. -- that does seem to be significant because I created an example where the json string is a little longer before that part, and it still truncates right after "Error". ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:31am UTC](https://discuss.elastic.co/t/kvpairs-where-one-of-the-values-is-a-json-structure/27980/10 "2017-07-06T05:31:00Z")