# Logstash: parsing fields from json in array of another json
**URL:** https://discuss.elastic.co/t/logstash-parsing-fields-from-json-in-array-of-another-json/149854
**Category:** Logstash
**Created:** [September 25, 2018, 2:42pm UTC](https://discuss.elastic.co/t/logstash-parsing-fields-from-json-in-array-of-another-json/149854 "2018-09-25T14:42:21Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Jiri\_Petak](https://discuss.elastic.co/u/Jiri_Petak)
#### Post date: [September 25, 2018, 2:42pm UTC](https://discuss.elastic.co/t/logstash-parsing-fields-from-json-in-array-of-another-json/149854/1 "2018-09-25T14:42:21Z")
Hi, i would like to parse some fields from json logs from AWS WAF. On input logstash use:
s3 {
bucket =\> "XXXX"
access\_key\_id =\> "XXXX"
secret\_access\_key =\> "XXXX"
prefix =\> "waf/"
region =\> "XXX"
sincedb\_path =\> "/tmp/s3.sincedb"
add\_field =\> ["lso\_name", "NULL", "lsi\_type", "s3", "lsi\_name", "waf"]
codec =\> "json"
}
I get messages like:
{
"httpSourceName"=\>"CF",
"httpRequest"=\> {
"clientIp"=\>"XX.XX.XX.XX",
"httpMethod"=\>"GET",
"requestId"=\>"XXXX",
"uri"=\>"XXX",
"headers"=\>
[
{"name"=\>"Host", "value"=\>"[test.exmaple.com](http://test.exmaple.com)"},
{"name"=\>"user-agent", "value"=\>"Mozilla/5.0"},
{"name"=\>"accept", "value"=\>"_/_"}
]
}
}
I am trying to parse that header in logstash filter, but cant do it.
Output in kibana should be like:
"httpRequest.headers.Host" =\> "[test.example.com](http://test.example.com)"
"httpRequest.headers.user-agent" =\> "Mozilla/5.0"
I tryed json filter even kv, but with no success.
Thanks for any reply.
---
### Author:  [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [September 26, 2018, 12:23am UTC](https://discuss.elastic.co/t/logstash-parsing-fields-from-json-in-array-of-another-json/149854/2 "2018-09-26T00:23:54Z")
As it currently stands, your Elasticsearch index is getting a field `httpRequest.headers.name` and another called `httpRequest.headers.value`, which doesn't allow you to map names to values.
The array-of-objects will need to be _transposed_ into a single object with named values.
I made something for you 🙂
>
With the above-linked `transpose.logstash-filter-ruby.rb`, you could do the following:
```auto
filter {
ruby {
path => "/path/to/transpose.logstash-filter-ruby.rb"
script_params => {
"source" => "[httpRequest][headers]"
}
}
}
```
---
### Author:  [@Jiri\_Petak](https://discuss.elastic.co/u/Jiri_Petak)
#### Post date: [September 26, 2018, 9:09am UTC](https://discuss.elastic.co/t/logstash-parsing-fields-from-json-in-array-of-another-json/149854/3 "2018-09-26T09:09:19Z")
Thanks, thats awesome! Works like a charm
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 24, 2018, 9:09am UTC](https://discuss.elastic.co/t/logstash-parsing-fields-from-json-in-array-of-another-json/149854/4 "2018-10-24T09:09:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.