# Logstash Filter Json To Array of Json

**URL:** <https://discuss.elastic.co/t/logstash-filter-json-to-array-of-json/181345>\
**Category:** Logstash\
**Created:** [May 16, 2019, 9:24am UTC](https://discuss.elastic.co/t/logstash-filter-json-to-array-of-json/181345 "2019-05-16T09:24:00Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 16, 2019, 1:56pm UTC](https://discuss.elastic.co/t/logstash-filter-json-to-array-of-json/181345/6 "2019-05-16T13:56:39Z")

</div>

OK. You could do it using json\_encode (which you will need to install). First copy all the interesting fields to another field, which we can put in [@metadata]

```
    mutate { remove_field => ["@timestamp", "@version", "host", "message", "sequence"] }
    ruby {
        code => '
            event.to_hash.each { |k,v|
                event.set("[@metadata][fields][#{k}]", v)
            }
        '
    }

```

Then encode it into another field, which again can be in [@metadata]

```
    json_encode { source => "[@metadata][fields]" target => "[@metadata][string]" }

```

and output it using a plain codec

```
output { stdout { codec => plain { format => "[%{[@metadata][string]} ]
" } } }

```

Note that you use a literal newline in the format string to tell it to append a newline to the output.

---

_[View the full topic](https://discuss.elastic.co/t/logstash-filter-json-to-array-of-json/181345)._