# Logstash multiple json field

**URL:** <https://discuss.elastic.co/t/logstash-multiple-json-field/232138>\
**Category:** Logstash\
**Created:** [May 12, 2020, 5:39am UTC](https://discuss.elastic.co/t/logstash-multiple-json-field/232138 "2020-05-12T05:39:27Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ohoroyoi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ohoroyoi/32/46820_2.png) [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\
**Post date:** [May 12, 2020, 5:39am UTC](https://discuss.elastic.co/t/logstash-multiple-json-field/232138/1 "2020-05-12T05:39:27Z")

</div>

I want to send postgres data to elasticsearch using logstash.

I have json column more than one in postgres table.

for example, continent and country column are both json type.

then, How can I configure filter option?

```auto
filter {
        json {
               source => "continent"
       }
}

```

In the document, it explains just one json field.  
but I have lots of json field.

Can anybody configure this?  
thank you in advance.

in my table, continent and country is json field.

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [May 12, 2020, 1:23pm UTC](https://discuss.elastic.co/t/logstash-multiple-json-field/232138/2 "2020-05-12T13:23:30Z")

</div>

Hi there,

can you post here a sample of what logstash sees when querying your postgres? What does the following pipeline spit out?

```
input {
  whatever your input is
}

filter {}

output {
  stdout{}
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 12, 2020, 2:45pm UTC](https://discuss.elastic.co/t/logstash-multiple-json-field/232138/3 "2020-05-12T14:45:56Z")

</div>

Use a second json filter to parse the second column.

---

<div class="post-metadata">

**Author:** ![ohoroyoi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ohoroyoi/32/46820_2.png) [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\
**Post date:** [May 13, 2020, 6:16am UTC](https://discuss.elastic.co/t/logstash-multiple-json-field/232138/4 "2020-05-13T06:16:51Z")

</div>

hey. look. as you see, I'm newbie. without example, You don't have to answer this.

---

<div class="post-metadata">

**Author:** ![ohoroyoi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ohoroyoi/32/46820_2.png) [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\
**Post date:** [May 13, 2020, 6:39am UTC](https://discuss.elastic.co/t/logstash-multiple-json-field/232138/5 "2020-05-13T06:39:40Z")

</div>

```auto
|region_id |continent |country |
|----------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------|
|1000 |{"id": "500001", "code": "NA", "name": "북아메리카", "type": "continent", "name_en": "North America"} |{"id": "201", "code": "US", "name": "미국", "type": "country", "code3": "USA", "name_en": "United Stat|

```

My example data looks like this.  
and **continent column is json type**.

Here is my current conf.file

```auto
input {
      jdbc {
            jdbc_connection_string => "jdbc:postgresql://ip:port/dbname"
            jdbc_user => "user"
            jdbc_password => "password"
            jdbc_driver_library => "/lib/jar_location"
            schedule => "*/15 * * * *"
            statement => "SELECT region_id, continent, country from expedia_region_union order by region_id asc LIMIT 100"
      }
      stdin {
            codec => plain { charset => "UTF-8" }
      }
}

filter {
        json {
              source => "message"
              add_field => { "continent" => "continent" }
        }
        json {
              source => "message"
              add_field => {"country" => "country" }
         }
}

output {
       elasticsearch {
           hosts => ["host"]
           index => "index_name"
           doc_as_upsert => true
           action => "update"
           document_if => "%{region_id}"
     }
     stdout { codec => rubydebug }
}

```

and this not works. how can I configure correctly to send json columns.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 13, 2020, 2:30pm UTC](https://discuss.elastic.co/t/logstash-multiple-json-field/232138/6 "2020-05-13T14:30:28Z")

</div>

If both the continent and country fields are JSON then use

```
    json { source => "continent" }
    json { source => "country" }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 10, 2020, 2:37pm UTC](https://discuss.elastic.co/t/logstash-multiple-json-field/232138/7 "2020-06-10T14:37:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.