# Logstash nested JSON Array, split and parse on nested JSON without using Ruby code

**URL:** <https://discuss.elastic.co/t/logstash-nested-json-array-split-and-parse-on-nested-json-without-using-ruby-code/380985>\
**Category:** Logstash\
**Created:** [August 13, 2025, 3:42am UTC](https://discuss.elastic.co/t/logstash-nested-json-array-split-and-parse-on-nested-json-without-using-ruby-code/380985 "2025-08-13T03:42:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yelinaung](https://avatars.discourse-cdn.com/v4/letter/y/d78d45/32.png) [@yelinaung](https://discuss.elastic.co/u/yelinaung)\
**Post date:** [August 13, 2025, 3:42am UTC](https://discuss.elastic.co/t/logstash-nested-json-array-split-and-parse-on-nested-json-without-using-ruby-code/380985/1 "2025-08-13T03:42:22Z")

</div>

How to split separate field on nested JSON Array.

Can someone kindly help with this? Thank you.

Below is the nested JSON array

![image](https://us1.discourse-cdn.com/elastic/original/3X/e/9/e9c79f867a250f5e1222cbed4e7eec80322d63a8.png)

Sample JSON Code

```auto
"http": {
  "request": {
    "headers": [
   {
     "Name": "Host",
     "Value": "example.com"
    },
    {
      "Name": "Connection",
      "Value": "keep-alive"
    }
   ]
  }
}

```

Sample My Code

```auto
split {
      field => "[http][request][headers]"
    }
    mutate {
      add_field => {
        "[http][request][headers][%{[http][request][headers][Name]}]" => "%{[http][request][headers][Value]}"
    }
      remove_field => [
         "[http][request][headers][Name]",
         "[http][request][headers][Value]"
     ]
  }

```

After the code output is getting only one field

![image](https://us1.discourse-cdn.com/elastic/original/3X/b/1/b1a09cf9c3d65dbcd4f74f362f46a0c38c98c07d.png)

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [August 13, 2025, 6:47am UTC](https://discuss.elastic.co/t/logstash-nested-json-array-split-and-parse-on-nested-json-without-using-ruby-code/380985/2 "2025-08-13T06:47:08Z")

</div>

Hello @yelinaung

If we consider below as an example record :

```auto
{"timestamp":"2025-08-13T06:40:00Z","http":{"request":{"headers":[{"Name":"Host","Value":"my.demo.net"},{"Name":"Connection","Value":"keep-alive"},{"Name":"Accept","Value":""},{"Name":"platform","Value":"raspberry-pi"}]}}}

```

Tried using below filter to map 4 fields to 4 values :

```auto
filter {
  mutate {
    add_field => { "message" => "%{[event][original]}" }
  }
  if [http][request][headers] {
    mutate {
      add_field => {
        "Host" => "%{[http][request][headers][0][Value]}"
        "Connection" => "%{[http][request][headers][1][Value]}"
        "Accept" => "%{[http][request][headers][2][Value]}"
        "platform" => "%{[http][request][headers][3][Value]}"
      }
    }
  }
  mutate {
    remove_field => ["http", "timestamp", "event", "log", "@version"]
  }
}

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/b/db3e016bed9c68a2e4b11cab3a447dce0026dc77.png)

Thanks!!

---

<div class="post-metadata">

**Author:** ![yelinaung](https://avatars.discourse-cdn.com/v4/letter/y/d78d45/32.png) [@yelinaung](https://discuss.elastic.co/u/yelinaung)\
**Post date:** [August 14, 2025, 2:36am UTC](https://discuss.elastic.co/t/logstash-nested-json-array-split-and-parse-on-nested-json-without-using-ruby-code/380985/3 "2025-08-14T02:36:14Z")

</div>

Thanks for your instruction.