# Logstash parse JSON into individual events

**URL:** <https://discuss.elastic.co/t/logstash-parse-json-into-individual-events/230661>\
**Category:** Logstash\
**Created:** [May 1, 2020, 3:04am UTC](https://discuss.elastic.co/t/logstash-parse-json-into-individual-events/230661 "2020-05-01T03:04:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\
**Post date:** [May 1, 2020, 3:04am UTC](https://discuss.elastic.co/t/logstash-parse-json-into-individual-events/230661/1 "2020-05-01T03:04:30Z")

</div>

Hi,  
Im trying an HTTP Poller which returns me the response in the below format:

{"term":"hamma","suggestions":{"cities":[{"id":101509,"name":"Hammaliya","type":"city","region":"Sri Lanka","country":"Sri Lanka"},{"id":81633,"name":"Hammam Chott","type":"city","region":"North Coast","country":"Tunisia"},{"id":93911,"name":"Hammam Sousse","type":"city","region":"Sousse","country":"Tunisia"},{"id":902,"name":"Hammamet","type":"city","region":"","country":"Tunisia"},{"id":8289,"name":"Hammamet-Yasmine","type":"city","region":"Hammamet","country":"Tunisia"},{"id":69291,"name":"Hammana","type":"city","region":"Lebanon","country":"Lebanon"},{"id":57088,"name":"Hammanskraal","type":"city","region":"Johannesburg & surrounding area","country":"South Africa"},{"id":63037,"name":"Hammar","type":"city","region":"Svealand","country":"Sweden"},{"id":106862,"name":"Hammarland","type":"city","region":"Aland Islands","country":"Finland"},{"id":82810,"name":"Hammarö","type":"city","region":"Svealand","country":"Sweden"},{"id":55589,"name":"Hammarstrand","type":"city","region":"Norrland","country":"Sweden"}],"properties":}}

The requirement for me is to store each of the citiesitem (array element) as a separate event in the elastic search. To be specific , I want to extract the term ,id, name, type,region,country and properties for each record and pass this individual event to the ElasticSearch output plugin.

Can you help on this?

my logstash file conf:  
input {  
http\_poller {  
urls =\> {  
url =\> "XXX"  
}  
request\_timeout =\> 60  
schedule =\> { every =\> "60s" }  
codec =\> "json"  
}  
}  
filter {  
json {  
source =\> "term"  
}  
}  
output {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "test"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [May 1, 2020, 4:33am UTC](https://discuss.elastic.co/t/logstash-parse-json-into-individual-events/230661/2 "2020-05-01T04:33:57Z")

</div>

what does you stdout output looks like ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 1, 2020, 1:15pm UTC](https://discuss.elastic.co/t/logstash-parse-json-into-individual-events/230661/3 "2020-05-01T13:15:07Z")

</div>

> [@hiba](#):
>
> The requirement for me is to store each of the citiesitem (array element) as a separate event in the Elasticsearch.

Try

```
split { field => "[suggestions][cities]" }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 29, 2020, 1:15pm UTC](https://discuss.elastic.co/t/logstash-parse-json-into-individual-events/230661/4 "2020-05-29T13:15:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.