# Logstash how to transform custom json data to multiple data

**URL:** <https://discuss.elastic.co/t/logstash-how-to-transform-custom-json-data-to-multiple-data/114642>\
**Category:** Logstash\
**Created:** [January 9, 2018, 6:04am UTC](https://discuss.elastic.co/t/logstash-how-to-transform-custom-json-data-to-multiple-data/114642 "2018-01-09T06:04:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![beiming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/beiming/32/26371_2.png) [@beiming](https://discuss.elastic.co/u/beiming)\
**Post date:** [January 9, 2018, 6:04am UTC](https://discuss.elastic.co/t/logstash-how-to-transform-custom-json-data-to-multiple-data/114642/1 "2018-01-09T06:04:10Z")

</div>

Hi, I use Logstash 6.1.1, and use http plugin put json data to logstash.  
some data like:

```auto
	"@timestamp": "2018-01-09T02:50:59.776Z",
	"headers": {
		......
	},
	"key1": "value1"
	"key2": "value2"
	"logs": ["2018-01-09 02:35:14.365 [main] message1", 
			 "2018-01-09 02:35:15.365 [Launcher] message2", 
			 "2018-01-09 02:35:16.365 [main] message3", 
			 "2018-01-09 02:35:17.365 [main] message4", 
	......
	]
}

```

and I want split and transform this data to multiple data like

```auto
{
	"@timestamp": "2018-01-09T02:50:59.776Z",
	"headers": {
		......
	},
	"key1": "value1"
	"key2": "value2"
	"log": "2018-01-09 02:35:14.365 [main] message1"
	"logTime": "2018-01-09 02:35:14.365",
	"thread": "main",
	"message": "message1"
	]
}

{
	"@timestamp": "2018-01-09T02:50:59.776Z",
	"headers": {
		......
	},
	"key1": "value1"
	"key2": "value2"
	"log": "2018-01-09 02:35:15.365 [Launcher] message2"
	"logTime": "2018-01-09 02:35:15.365",
	"thread": "Launcher",
	"message": "message2"
	]
}
......

```

How can I do? Thanks for view.

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [January 10, 2018, 4:32pm UTC](https://discuss.elastic.co/t/logstash-how-to-transform-custom-json-data-to-multiple-data/114642/2 "2018-01-10T16:32:32Z")

</div>

Try the [split filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html#_description_128).

```auto
 split {
   field => "logs"
   target => "log"
 }

```

---

<div class="post-metadata">

**Author:** ![beiming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/beiming/32/26371_2.png) [@beiming](https://discuss.elastic.co/u/beiming)\
**Post date:** [January 11, 2018, 6:58am UTC](https://discuss.elastic.co/t/logstash-how-to-transform-custom-json-data-to-multiple-data/114642/3 "2018-01-11T06:58:20Z")

</div>

thanks, use split and grok filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2018, 6:58am UTC](https://discuss.elastic.co/t/logstash-how-to-transform-custom-json-data-to-multiple-data/114642/4 "2018-02-08T06:58:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.