# Logstash filebeat pipeline to ingest json logs - parse array

**URL:** <https://discuss.elastic.co/t/logstash-filebeat-pipeline-to-ingest-json-logs-parse-array/165669>\
**Category:** Logstash\
**Created:** [January 24, 2019, 9:29pm UTC](https://discuss.elastic.co/t/logstash-filebeat-pipeline-to-ingest-json-logs-parse-array/165669 "2019-01-24T21:29:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fefo69](https://avatars.discourse-cdn.com/v4/letter/f/b5a626/32.png) [@fefo69](https://discuss.elastic.co/u/fefo69)\
**Post date:** [January 24, 2019, 9:29pm UTC](https://discuss.elastic.co/t/logstash-filebeat-pipeline-to-ingest-json-logs-parse-array/165669/1 "2019-01-24T21:29:49Z")

</div>

Hi,

I'm trying to ingest json log files, running filebeat and logstash, in log file I have transactions with the following format.

I need to parse the logs and send to elastic a few set of fields of each transaction, but "legs" is an array of two json objects, and I need to get some of the fields inside. For example I need to get the content of legs.[0].status and add a new field

Im using json filter in logstash. So far the pipeline is working but I'm not able to capture the content inside the arrays as mentioned.

Transaction logs:  
{  
"type": "transaction",  
"time": 1548106086406,  
"path": "/ri/ticketing/v2/tickets/{ticketId}",  
"protocol": "http",  
"protocolSrc": "8080",  
"duration": 29,  
"status": "success",  
"serviceContexts": [  
{  
"service": "ticketManagement",  
"monitor": true,  
"client": "a41c329e-5207-4970-a144-1a9aefcf8935",  
"org": null,  
"app": null,  
"method": "ticket",  
"status": "success",  
"duration": 29  
}  
],  
"customMsgAtts": {},  
"correlationId": "6639465c89f30d6686821faa",  
"legs": [  
{  
"uri": "/ri/ticketing/v2/tickets/9152650204213262392",  
"status": 200,  
"statustext": "OK",  
"method": "GET",  
"vhost": null,  
"wafStatus": 0,  
"bytesSent": 2850,  
"bytesReceived": 954,  
"remoteName": "127.0.0.1",  
"remoteAddr": "127.0.0.1",  
"localAddr": "127.0.0.1",  
"remotePort": "60704",  
"localPort": "8080",  
"sslsubject": null,  
"leg": 0,  
"timestamp": 1548106086377,  
"duration": 29,  
"serviceName": "ticketManagement",  
"subject": "a41c329e-5207-4970-a144-1a9aefcf8935",  
"operation": "ticket",  
"type": "http",  
"finalStatus": "Pass"  
},  
{  
"uri": "/api/v1/troubleTicket/9152650204213262392",  
"status": 200,  
"statustext": "",  
"method": "GET",  
"vhost": null,  
"wafStatus": 0,  
"bytesSent": 1121,  
"bytesReceived": 2865,  
"remoteName": "tbapi.com.uy",  
"remoteAddr": "10.24.135.51",  
"localAddr": "10.24.34.132",  
"remotePort": "8002",  
"localPort": "44820",  
"sslsubject": "/OU=Domain Control Validated/CN=\*.com",  
"leg": 1,  
"timestamp": 1548106086377,  
"duration": 25,  
"serviceName": "ticketManagement",  
"subject": "a41c329e-5207-4970-a144-1a9aefcf8935",  
"operation": "ticket",  
"type": "http",  
"finalStatus": null  
}  
]  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 24, 2019, 9:57pm UTC](https://discuss.elastic.co/t/logstash-filebeat-pipeline-to-ingest-json-logs-parse-array/165669/2 "2019-01-24T21:57:47Z")

</div>

I accidentally posted this to the wrong thread. Let's try that again ...

```
mutate { add_field => { "foo" => "%{[legs][0][status]}" } }

```

will work. Note that foo will be a string and you will have to convert it to integer if that's what you need.

---

<div class="post-metadata">

**Author:** ![fefo69](https://avatars.discourse-cdn.com/v4/letter/f/b5a626/32.png) [@fefo69](https://discuss.elastic.co/u/fefo69)\
**Post date:** [January 25, 2019, 8:53pm UTC](https://discuss.elastic.co/t/logstash-filebeat-pipeline-to-ingest-json-logs-parse-array/165669/3 "2019-01-25T20:53:56Z")

</div>

Hi, I was able to solve it using the following setup:

Taking into account it will split the transaction log, in two transaction logs, one per leg. which is useful for my purposes.

input {  
beats {  
port =\> 5044  
}  
}

filter {  
json {  
source =\> "message"  
}  
split {  
field =\> "legs"  
}  
mutate {  
add\_field =\> {  
"legid" =\> "%{[legs][leg]}"  
}  
remove\_field =\> ["[message]" ]  
}  
.....  
}

Thanks for your reply !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2019, 8:54pm UTC](https://discuss.elastic.co/t/logstash-filebeat-pipeline-to-ingest-json-logs-parse-array/165669/4 "2019-02-22T20:54:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.