# Loop through json arrays **URL:** \ **Category:** Logstash\ **Created:** [May 13, 2020, 12:56am UTC](https://discuss.elastic.co/t/loop-through-json-arrays/232336 "2020-05-13T00:56:12Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\ **Post date:** [May 13, 2020, 12:56am UTC](https://discuss.elastic.co/t/loop-through-json-arrays/232336/1 "2020-05-13T00:56:13Z")
Hi, My JSON file looks like this : { "bookings": [ { "bookingId": 553267, "bookingRef": "VO20200108460", "statusId": 1, "status": "Confirmed", "rooms": [ { "board": "Demi pension", "paxes": { "adults": 2, "infant": 0, "children": 0 }, "quantity": 1, "room": "DOUBLE" }, { "board": "Demi pension", "paxes": { "adults": 1, "infant": 0, "children": 0 }, "quantity": 1, "room": "SINGLE" } ], "options": } } How do I loop through all rooms. my config file in logstash : input { http\_poller { urls =\> { url =\> "XXX" } request\_timeout =\> 60 schedule =\> { every =\> "60s" } codec =\> "json" } } filter { split { field =\> "[bookings]" } split { field =\> "[bookings][rooms]" } mutate { rename =\> { "[bookings][bookingId]" =\> "bookingId" "[bookings][status]" =\> "status" "[bookings][hotelId]" =\> "hotelId" "[bookings][hotelName]" =\> "hotelName" "[bookings][hotelCity]" =\> "hotelCity" "[bookings][hotelCountry]" =\> "hotelCountry" "[bookings][arrDate]" =\> "arrDate" "[bookings][depDate]" =\> "depDate" "[bookings][price]" =\> "price" "[bookings][currency]" =\> "currency" "[bookings][purchasePrice]" =\> "purchasePrice" "[bookings][partnerName]" =\> "partnerName" "[bookings][partnerId]" =\> "partnerId" "[bookings][firstName]" =\> "firstName" "[bookings][lastName]" =\> "lastName" "[bookings][channel]" =\> "channel" "[bookings][supplierName]" =\> "supplierName" "[bookings][rooms][board]" =\> "board" "[bookings][rooms][paxes][adults]" =\> "adults" "[bookings][rooms][paxes][infant]" =\> "infant" "[bookings][rooms][paxes][children]" =\> "children" "[bookings][rooms][quantity]" =\> "quantity" "[bookings][rooms][room]" =\> "room" } remove\_field =\> ["confirmedDate", "bookingRef", "bookings", "createdDate", "hotelAddress", "hotelPhonearrDate", "customerId", "title", "email", "city", "mobile", "supplierId","paxe", "payments", "options", "isXML"] } } output { elasticsearch { hosts =\> "localhost:9200" index =\> "bookings" action =\> "update" doc\_as\_upsert =\> "true" document\_id =\> "%{bookingId}" } stdout { codec =\> rubydebug } } Any help please ! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 13, 2020, 2:36pm UTC](https://discuss.elastic.co/t/loop-through-json-arrays/232336/2 "2020-05-13T14:36:22Z")
What do you not like about the resulting output? ---
**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\ **Post date:** [May 14, 2020, 1:10pm UTC](https://discuss.elastic.co/t/loop-through-json-arrays/232336/3 "2020-05-14T13:10:35Z")
i can't have all the data : ![loop](https://us1.discourse-cdn.com/elastic/original/3X/5/0/50420db623d6b89a1f244e155630d54a95787925.png) in the document above there is no double room { "board": "Demi pension", "paxes": { "adults": 2, "infant": 0, "children": 0 }, "quantity": 1, "room": "DOUBLE" }, ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 14, 2020, 2:35pm UTC](https://discuss.elastic.co/t/loop-through-json-arrays/232336/4 "2020-05-14T14:35:50Z")
> [@hiba](#): > > in the document above there is no double room You have a split filter that is splitting "[bookings][rooms]", so you will only have one room per document. ---
**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\ **Post date:** [May 14, 2020, 4:24pm UTC](https://discuss.elastic.co/t/loop-through-json-arrays/232336/5 "2020-05-14T16:24:09Z")
what can i do to have all the rooms per document !? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 14, 2020, 5:00pm UTC](https://discuss.elastic.co/t/loop-through-json-arrays/232336/6 "2020-05-14T17:00:13Z")
Remove the second split filter: ``` # split { field => "[bookings][rooms]" } ``` ---
**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\ **Post date:** [May 15, 2020, 2:00pm UTC](https://discuss.elastic.co/t/loop-through-json-arrays/232336/7 "2020-05-15T14:00:16Z")
![lo](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5e9090e6f13478ce4bf3c85ed4ed7b3d88c0525b.png) it displays no rooms ☹ ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 15, 2020, 3:09pm UTC](https://discuss.elastic.co/t/loop-through-json-arrays/232336/8 "2020-05-15T15:09:52Z")
> [@hiba](#): > > it displays no rooms That is because you remove the bookings field. Change your mutate+rename to include ``` "[bookings][rooms]" => "rooms" ``` ---
**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\ **Post date:** [May 15, 2020, 9:51pm UTC](https://discuss.elastic.co/t/loop-through-json-arrays/232336/9 "2020-05-15T21:51:03Z")
it's work.. but I can't do aggregation on the field rooms ..... i need this field rooms to build my dashboards..... ![lop](https://us1.discourse-cdn.com/elastic/original/3X/f/7/f7303cf35b326142f64db9f37dae2f37dd725513.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 15, 2020, 10:00pm UTC](https://discuss.elastic.co/t/loop-through-json-arrays/232336/10 "2020-05-15T22:00:41Z")
OK, let's backtrack. If you go back to your original configuration, if a booking has multiple rooms, then when you do the split on [bookings][rooms] you will get multiple events with the same [booking\_id]. In your elasticsearch filter you are using ``` document_id => "%{bookingId}" ``` so it will update the document by overwriting the first room with the second room. If you want multiple documents for the same booking id then remove that. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 12, 2020, 10:01pm UTC](https://discuss.elastic.co/t/loop-through-json-arrays/232336/11 "2020-06-12T22:01:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.