# Logstash json-filter - Wildchar to fetch fields

**URL:** <https://discuss.elastic.co/t/logstash-json-filter-wildchar-to-fetch-fields/198597>\
**Category:** Logstash\
**Created:** [September 9, 2019, 4:38am UTC](https://discuss.elastic.co/t/logstash-json-filter-wildchar-to-fetch-fields/198597 "2019-09-09T04:38:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![nilesh1](https://avatars.discourse-cdn.com/v4/letter/n/b487fb/32.png) [@nilesh1](https://discuss.elastic.co/u/nilesh1)\
**Post date:** [September 9, 2019, 4:38am UTC](https://discuss.elastic.co/t/logstash-json-filter-wildchar-to-fetch-fields/198597/1 "2019-09-09T04:38:55Z")

</div>

New to Logstash, I am using logstash JSON filter plugin.

JSON payloads look like [each line new log entry]

```
{ "RequestOne": { "Header": { "MessageID": "41019e6b-e2da-4303-88df-859765d0fbe3","CreationDateTime": "2019-01-28T12:29:42.106Z", "SenderParty": "soapUI" }, "Data":{ <other data>} } }
{ "RequestTwo": { "Header": { "MessageID": "41019e6b-e2da-4303-88df-859765d0fbe3","CreationDateTime": "2019-01-28T12:29:42.106Z", "SenderParty": "soapUI" }, "Data":{ <other data>} } }
{ "RequestThree": { "Header": { "MessageID": "41019e6b-e2da-4303-88df-859765d0fbe3", "CreationDateTime": "2019-01-28T12:29:42.106Z", "SenderParty": "soapUI" }, "Data":{ <other data>} } }

```

JSON Filter config look like

```
json{
        source => "data"
        target => "parsed_json"
}

mutate{
        add_field => {
            "MessageID" => "%{[parsed_json][RequestOne][Header][MessageID]}"
            }
        }

```

With this i am able to create field MessageID with proper details. But i want to have it generic for so it should not look for RequestOne and to have something like this

```auto
%{[parsed_json][*][Header][MessageID]} 

```

using wildchar.

Is there any way to achieve this?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 9, 2019, 5:56am UTC](https://discuss.elastic.co/t/logstash-json-filter-wildchar-to-fetch-fields/198597/2 "2019-09-09T05:56:15Z")

</div>

Not that I know of, so you may need to use a ruby filter.

---

<div class="post-metadata">

**Author:** ![nilesh1](https://avatars.discourse-cdn.com/v4/letter/n/b487fb/32.png) [@nilesh1](https://discuss.elastic.co/u/nilesh1)\
**Post date:** [September 9, 2019, 8:20am UTC](https://discuss.elastic.co/t/logstash-json-filter-wildchar-to-fetch-fields/198597/3 "2019-09-09T08:20:12Z")

</div>

I see, time to learn ruby...

[Anyone any handy code which can be used]

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 9, 2019, 11:54am UTC](https://discuss.elastic.co/t/logstash-json-filter-wildchar-to-fetch-fields/198597/4 "2019-09-09T11:54:43Z")

</div>

```
    ruby {
        code => '
            event.get("[parsed_json]").each { |k, v|
                event.set("messageId", v["Header"]["MessageID"])
            }
        '
    }
```

---

<div class="post-metadata">

**Author:** ![nilesh1](https://avatars.discourse-cdn.com/v4/letter/n/b487fb/32.png) [@nilesh1](https://discuss.elastic.co/u/nilesh1)\
**Post date:** [September 9, 2019, 12:14pm UTC](https://discuss.elastic.co/t/logstash-json-filter-wildchar-to-fetch-fields/198597/5 "2019-09-09T12:14:08Z")

</div>

Thanks Badger!

I achieved it like this, Your approach looks much better 🙂

```
ruby {
    code => "
				require 'json'
				hash = JSON.parse(event.get('parsed_json'))
				event.set('MessageID',hash.values[0]['Header']['MessageID'])
    "
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 7, 2019, 12:14pm UTC](https://discuss.elastic.co/t/logstash-json-filter-wildchar-to-fetch-fields/198597/6 "2019-10-07T12:14:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.