# Logstash parsing in JSON
**URL:** https://discuss.elastic.co/t/logstash-parsing-in-json/249659
**Category:** Logstash
**Created:** [September 23, 2020, 12:35pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659 "2020-09-23T12:35:01Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)
#### Post date: [September 23, 2020, 12:35pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/1 "2020-09-23T12:35:01Z")
Hello,
I have a json in the following format.
{"group" : [{"name":"group1","tag":[{"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}]}],"association" : }
Using Logstash config I have to parse tag field and add tags , Hence I have my config filter part as below,
split {
field =\> "group"
}
mutate{
add\_field =\> {"tag" =\> "%[group][tag][name]"}
}
But I am getting the result ingested as tag:[group][tag][name].
Kindly suggest where do I have to change my config.
---
### Author:  [@grumo35](https://discuss.elastic.co/u/grumo35)
#### Post date: [September 23, 2020, 12:39pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/2 "2020-09-23T12:39:05Z")
Hi,
```auto
add_tag => ["%{[group][tag][name]}"]
```
Should do the trick
---
### Author:  [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)
#### Post date: [September 23, 2020, 1:02pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/3 "2020-09-23T13:02:41Z")
Hi @grumo35,
Thanks for the reply.
I have tried this. It is adding tags. Instead I want data to be ingested as,
tag [0]: tag1
tag [1]: tag2 and so on
where tag1,tag2,tag are part of json which has the above format mentioned in the case raised.
---
### Author:  [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)
#### Post date: [September 23, 2020, 1:06pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/4 "2020-09-23T13:06:20Z")
To add up, after changing
add\_tag =\> ["%{[group][tag][name]}"]
the result is as below,
tags" =\> [
[0] "["tag", "%{[group][tag][name]}"]"
---
### Author:  [@grumo35](https://discuss.elastic.co/u/grumo35)
#### Post date: [September 23, 2020, 1:07pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/5 "2020-09-23T13:07:42Z")
I'm not sure to fully understand your use case but you might wan to iterate over results in ruby to match the tag array position you want to use.
Did you manage to get it work ?
---
### Author:  [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)
#### Post date: [September 23, 2020, 1:08pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/6 "2020-09-23T13:08:37Z")
No still I am trying.
---
### Author:  [@grumo35](https://discuss.elastic.co/u/grumo35)
#### Post date: [September 23, 2020, 1:11pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/7 "2020-09-23T13:11:41Z")
> [@Logstash::Event and Ruby code for dynamic tags with Logstash 2.3.4](https://discuss.elastic.co/t/logstash-event-and-ruby-code-for-dynamic-tags-with-logstash-2-3-4/71458):
>
> Hi. I use Logstash 2.3.4 to read events from Kafka broker and have a problem with the filtering. I am trying to flatten the uniq\_log\_name1 object and turn uniq\_log\_name1 into a tag. My problem is not knowing what dynamic variable is available within the Ruby code interpreter after Kafka decodes the event as JSON. My testing works fine on the command-line but when using the Kafka input it fails because of the JSON decoding. I know this by testing with json codec on stdin and by disabling jso…
---
### Author:  [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)
#### Post date: [September 23, 2020, 1:25pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/8 "2020-09-23T13:25:42Z")
But I dont want to add tags. In my case I want to parse the inner value of the json file.
Like in my case
{"group" : [{"name":"group1","tag":[{"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}]}],"association" : }
When I give,
split {
field =\> "group"
}
mutate{
add\_field =\> {"tag" =\> "%[group][tag]"}
}
I am getting the output as tag: {"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}
But when I change that to,
add\_field =\> {"tag" =\> "%[group][tag][name]"}
I data is getting ingested as tag:[group][tag][name]
---
### Author:  [@chitreshg](https://discuss.elastic.co/u/chitreshg)
#### Post date: [September 30, 2020, 12:36pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/9 "2020-09-30T12:36:48Z")
it seems you want **tag** as a separate field as an array which contain ["tag1", "tag2", "tag3"]
if this is your requirement then you can use ruby filter to get such pattern.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 30, 2020, 1:15pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/10 "2020-09-30T13:15:51Z")
Why are you using split when there is only a single member in the [group] array? You could just use
```
mutate { add_field => { "group" => "%{[group][0]}" } }
```
For the example data in the first post what do you want the final event to look like?
---
### Author:  [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)
#### Post date: [September 30, 2020, 2:23pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/11 "2020-09-30T14:23:38Z")
Thank you all for the suggestion.
I could get a single tag by giving like below,
"tag1" =\> "%{[group][tag][0][name]}"
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 30, 2020, 3:14pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/12 "2020-09-30T15:14:56Z")
Does that mean your problem is solved? If not, what do you want the event fields to look like?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 28, 2020, 3:14pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659/13 "2020-10-28T15:14:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.