# Logstash data formatting help

**URL:** https://discuss.elastic.co/t/logstash-data-formatting-help/97834
**Category:** Logstash
**Created:** [August 22, 2017, 12:21am UTC](https://discuss.elastic.co/t/logstash-data-formatting-help/97834 "2017-08-22T00:21:09Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![capaneus](https://avatars.discourse-cdn.com/v4/letter/c/41988e/32.png) [@capaneus](https://discuss.elastic.co/u/capaneus)
#### Post date: [August 22, 2017, 12:21am UTC](https://discuss.elastic.co/t/logstash-data-formatting-help/97834/1 "2017-08-22T00:21:09Z")

</div>

Hi,  
I know this is very basic newbee question, but I hope can get some of your time to shed me some light on this.

Now I have structured json data after a few filters:  
filter {  
json {  
source =\> "message"  
}

```
	split {
		field => "@message"
	}
}

```

The data look like this:  
{  
"@message": {  
"field name 1": "field data"  
"field name 2": {  
"field name 3": "field data",  
"field name 4": "field data",  
...  
}  
...  
},  
"@tags": [  
"tag 1", "tag 2" ],  
"@timestamp": "2017-08-21T23:37:47.244Z",  
"@version": "1",  
...  
}

I wish to flattern a bit the data to something like this:  
{  
"field name 1": "field data",  
"field name 2": "field data",  
"field name 3": "field data",  
"field name 4": "field data",  
...  
"@tags": [  
"tag 1", "tag 2" ],  
"@timestamp": "2017-08-21T23:37:47.244Z",  
"@version": "1"  
}  
and take only the fields I'm interested. Would it be possible to show me how it can be achieved? Checked all the plugins but couldn't find something matching.

Thanks!

---

<div class="post-metadata">

### Author: ![capaneus](https://avatars.discourse-cdn.com/v4/letter/c/41988e/32.png) [@capaneus](https://discuss.elastic.co/u/capaneus)
#### Post date: [August 23, 2017, 10:57am UTC](https://discuss.elastic.co/t/logstash-data-formatting-help/97834/2 "2017-08-23T10:57:53Z")

</div>

Managed to solve the problem, a piece of ruby code will help:  
filter {  
split {  
field =\> "@message"  
}  
ruby {

```
        code => "
            obj = event.get('@message')
			if obj.is_a?Hash
				obj.each {|k,v|
					event.set(k, v)
				}
			end
        "
    }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 20, 2017, 10:58am UTC](https://discuss.elastic.co/t/logstash-data-formatting-help/97834/3 "2017-09-20T10:58:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.