# Logstash filter config to parse JSON
**URL:** https://discuss.elastic.co/t/logstash-filter-config-to-parse-json/53269
**Category:** Logstash
**Created:** [June 20, 2016, 6:14am UTC](https://discuss.elastic.co/t/logstash-filter-config-to-parse-json/53269 "2016-06-20T06:14:47Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@gugansankar](https://discuss.elastic.co/u/gugansankar)
#### Post date: [June 20, 2016, 6:14am UTC](https://discuss.elastic.co/t/logstash-filter-config-to-parse-json/53269/1 "2016-06-20T06:14:47Z")
I tried to parse json input file. But logstash doesn't parse the logs and not adding custom field "add\_field". I think, my filter configuration is wrong. Someone please help me on this.
Logs file:
`{"web1":{"stat1":{"mem":261831,"Name":"stat1","cpu":89}},"web2":{"stat2":{"mem":23456,"Name":"stat2","cpu":76}}`}
Logstash filter config:
```
filter {
if [type] == "localapp" {
if [Name] {
date {
target => "@timestamp"
locale => "en"
add_field => { "testapp" => "%{Name}"}
}
}
}
}
```
Output:
```
{
"web1" => {
"stat1" => {
"mem" => 261831,
"Name" => "stat1",
"cpu" => 89
}
},
"web2" => {
"stat2" => {
"mem" => 23456,
"Name" => "stat2",
"cpu" => 76
}
},
"@version" => "1",
"@timestamp" => "2016-06-20T05:52:25.002Z",
"type" => "localapp",
"host" => "gugan"
}
```
Here you can see custom field is not added.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 20, 2016, 6:21am UTC](https://discuss.elastic.co/t/logstash-filter-config-to-parse-json/53269/2 "2016-06-20T06:21:42Z")
Your JSON parses just fine.
However, your date filter doesn't contain a `match` option that specifies which field to parse and how it should be parsed. What are you trying to do here?
---
### Author:  [@gugansankar](https://discuss.elastic.co/u/gugansankar)
#### Post date: [June 20, 2016, 6:52am UTC](https://discuss.elastic.co/t/logstash-filter-config-to-parse-json/53269/3 "2016-06-20T06:52:38Z")
Thanks for your reply.
I done some correction and adding timestamp into the custom json value.
Log:
`{"web1":{"Name":"web1","stats":{"mem": 261831,"cpu":89,"timestamp":"2016-06-20 05:32:03"}}}`
Logstash Filter:
```
filter {
if [type] == "localapp" {
if [Name] {
date {
match => ["timestamp", "YYYY-MM-dd HH:mm:ss"]
target => "@timestamp"
locale => "en"
add_field => { "testapp" => "%{Name}"}
}
}
}
}
```
Expecting output:
1.) Use timestamp value what present on log message .
2.) Adding custom field for using it to creating separate document type per servers.
Above both conditions are not working . Please help.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 20, 2016, 7:28am UTC](https://discuss.elastic.co/t/logstash-filter-config-to-parse-json/53269/4 "2016-06-20T07:28:27Z")
Your fields aren't named `Name` and `timestamp`, they're named `[web1][Name]` and `[web1][stats][timestamp]`.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:51am UTC](https://discuss.elastic.co/t/logstash-filter-config-to-parse-json/53269/5 "2017-07-06T04:51:55Z")