# Logstash Filter || Json Message to Split Fields
**URL:** https://discuss.elastic.co/t/logstash-filter-json-message-to-split-fields/199713
**Category:** Logstash
**Created:** [September 16, 2019, 6:52pm UTC](https://discuss.elastic.co/t/logstash-filter-json-message-to-split-fields/199713 "2019-09-16T18:52:16Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@deeps](https://discuss.elastic.co/u/deeps)
#### Post date: [September 16, 2019, 6:52pm UTC](https://discuss.elastic.co/t/logstash-filter-json-message-to-split-fields/199713/1 "2019-09-16T18:52:16Z")
Could someone suggest the best and easy way to split the message into separate fields?
1. I have incoming messages in json format:
ex: message {"scenarioName":"x","id":"x","type":"x","source":"x","transaction":"x","appId":"x","template":"x","email":"x@blah.com","name":"x","lastName":"x ","data":{"Id":"x","source":"x"},"customData":{}}
and I would like to split each field for building dashboards in Kibana.
1. Would this put additional load on data nodes / elasticsearch?
2. Flow is logstash consuming kafka topics and pushing to elasticsearch.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 16, 2019, 7:21pm UTC](https://discuss.elastic.co/t/logstash-filter-json-message-to-split-fields/199713/2 "2019-09-16T19:21:25Z")
Since that is JSON I would use a json filter
```
filter { json { source => "message" remove_field => ["message"] } }
```
That will give you
```
{
"data" => {
"Id" => "x",
"source" => "x"
},
"@timestamp" => 2019-09-16T19:19:06.661Z,
"template" => "x",
"transaction" => "x",
"lastName" => "x ",
"scenarioName" => "x",
"name" => "x",
"id" => "x",
"type" => "x",
"email" => "x@blah.com",
"appId" => "x",
"customData" => {},
"source" => "x"
}
```
Obviously this parsing is not free, and indexing more fields costs more, but whether it is too expensive is a question only you can answer.
---
### Author:  [@deeps](https://discuss.elastic.co/u/deeps)
#### Post date: [September 16, 2019, 7:28pm UTC](https://discuss.elastic.co/t/logstash-filter-json-message-to-split-fields/199713/3 "2019-09-16T19:28:58Z")
works perfect, thanks for the quick help! @Badger
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 14, 2019, 7:29pm UTC](https://discuss.elastic.co/t/logstash-filter-json-message-to-split-fields/199713/4 "2019-10-14T19:29:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.