# Mapping json with logstash

**URL:** <https://discuss.elastic.co/t/mapping-json-with-logstash/106228>\
**Category:** Logstash\
**Created:** [November 2, 2017, 5:17pm UTC](https://discuss.elastic.co/t/mapping-json-with-logstash/106228 "2017-11-02T17:17:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![citanionarrei](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@citanionarrei](https://discuss.elastic.co/u/citanionarrei)\
**Post date:** [November 2, 2017, 5:17pm UTC](https://discuss.elastic.co/t/mapping-json-with-logstash/106228/1 "2017-11-02T17:17:17Z")

</div>

hi friends

I'm starting now to use elk and for this reason I'm not very experienced. I do not understand where and how to create a template on logstash to map my json.

someone can help me with a practical example. I have already read all about the creation on the template on the reference site as well

> **[​Little Logstash Lessons: Using Logstash to help create an Elasticsearch mapping...](https://www.elastic.co/blog/logstash_lesson_elasticsearch_mapping)**
>
> How to use Logstash together with Elasticsearch to create custom mapping templates. Improve your Elasticsearch storage and performance!

but I can not put it into practice  
i have this json of example and i want map it correctly.  
please can you help me?

{"venue":  
{"venue\_name":"Daniels Hall",  
"lon":-71.110497,  
"lat":43.180725,  
"venue\_id":733258},  
"visibility":"public",  
"response":"yes",  
"guests":0,  
"member":  
{"member\_id":58963232,  
"photo":"[https://secure.meetupstatic.com/photos/member/b/6/0/0/thumb\_68206592.jpeg","member\_name":"Carol"},"rsvp\_id":1697012514,"mtime](https://secure.meetupstatic.com/photos/member/b/6/0/0/thumb_68206592.jpeg%22,%22member_name%22:%22Carol%22%7D,%22rsvp_id%22:1697012514,%22mtime)":1509616048766,  
"event":  
{"event\_name":"Singles dance party at Daniels Hall.",  
"event\_id":"dnwlpfywpbfb","time":1509751800000,  
"event\_url":"[https://www.meetup.com/Nottingham-NH-Singles-Dance/events/244610141/](https://www.meetup.com/Nottingham-NH-Singles-Dance/events/244610141/)"},  
"group":  
{"group\_topics":[{"urlkey":"never-married","topic\_name":"Never Married"},  
{"urlkey":"widowed","topic\_name":"Widowed"},  
{"urlkey":"single-parties","topic\_name":"Single Parents"},  
{"urlkey":"women","topic\_name":"Women's Social"},  
{"urlkey":"socialnetwork","topic\_name":"Social Networking"},  
{"urlkey":"social","topic\_name":"Social"},  
{"urlkey":"dancing","topic\_name":"Dancing"},  
{"urlkey":"dating-and-relationships","topic\_name":"Dating and Relationships"},  
{"urlkey":"nightlife","topic\_name":"Nightlife"},  
{"urlkey":"singles","topic\_name":"Singles"},  
{"urlkey":"divorced","topic\_name":"Divorced"},  
{"urlkey":"singles-30s-50s","topic\_name":"Singles 30's-50's"},  
{"urlkey":"divorcesupport","topic\_name":"Divorce Support"},  
{"urlkey":"singles-dancing","topic\_name":"Singles Dancing"},  
{"urlkey":"newintown","topic\_name":"New In Town"}],  
"group\_city":"Nottingham",  
"group\_country":"us",  
"group\_id":1546303,  
"group\_name":"Nottingham NH Singles Dance. Now 172 marriages.",  
"group\_lon":-71.12,"group\_urlname":"Nottingham-NH-Singles-Dance",  
"group\_state":"NH",  
"group\_lat":43.09}}  
{"visibility":"public",  
"response":"yes",  
"guests":0,  
"member":{"member\_id":225397640,  
"other\_services":{"facebook":{"identifier":"[https://www.facebook.com/app\_scoped\_user\_id/10212829685359398/](https://www.facebook.com/app_scoped_user_id/10212829685359398/)"}},  
"photo":"[https://secure.meetupstatic.com/photos/member/1/8/f/2/thumb\_271086386.jpeg](https://secure.meetupstatic.com/photos/member/1/8/f/2/thumb_271086386.jpeg)",  
"member\_name":"Michael Yardeny"},  
"rsvp\_id":1694995732,  
"mtime":1509616048965,  
"event":{"event\_name":"מפגש קהילת הסטארט אפים ברמת גן",  
"event\_id":"243850832",  
"time":1509640200000,  
"event\_url":"[https://www.meetup.com/StartUp-Ramat-Gan/events/243850832/](https://www.meetup.com/StartUp-Ramat-Gan/events/243850832/)"},  
"group":{"group\_topics":[{"urlkey":"innovation",  
"topic\_name":"Innovation"},  
{"urlkey":"business-strategy",  
"topic\_name":"Business Strategy"},  
{"urlkey":"professional-networking",  
"topic\_name":"Professional Networking"},  
{"urlkey":"entrepreneurship",  
"topic\_name":"Entrepreneurship"},  
{"urlkey":"social-entrepreneurship",  
"topic\_name":"Social Entrepreneurship"},  
{"urlkey":"startup-businesses",  
"topic\_name":"Startup Businesses"},  
{"urlkey":"social-innovation",  
"topic\_name":"Social Innovation"},  
{"urlkey":"venture-capital",  
"topic\_name":"Venture Capital"},  
{"urlkey":"business-startup",  
"topic\_name":"Business Startup"},  
{"urlkey":"design-thinking",  
"topic\_name":"Design Thinking"},  
{"urlkey":"startup-incubation-and-entrepreneurship-mentors",  
"topic\_name":"Startup Incubation"},  
{"urlkey":"technology-startups",  
"topic\_name":"Technology Startups"}],  
"group\_city":"Ramat Gan",  
"group\_country":"il","group\_id":15162482,  
"group\_name":"StartUp Ramat Gan",  
"group\_lon":34.8,  
"group\_urlname":"StartUp-Ramat-Gan",  
"group\_lat":32.08}}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 3, 2017, 6:51am UTC](https://discuss.elastic.co/t/mapping-json-with-logstash/106228/2 "2017-11-03T06:51:25Z")

</div>

What part are you having trouble understanding? The syntax for the index template? What the point of the template even is? Something else?

---

<div class="post-metadata">

**Author:** ![citanionarrei](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@citanionarrei](https://discuss.elastic.co/u/citanionarrei)\
**Post date:** [November 3, 2017, 7:20am UTC](https://discuss.elastic.co/t/mapping-json-with-logstash/106228/3 "2017-11-03T07:20:52Z")

</div>

I have a set of log files that contain a json that I'll have to analyze.  
I managed to extract the interest json correctly from the document.  
Now I would like to create with logstash a mapping for this json.

Maybe, should I use something like that?

```
elasticsearch {
index => "log-%{+YYYY.MM.dd}"
document_type => "json_log"
	 # manage_template => true
	 # template => "E:\Programmi\logstash\bin\elasticsearch-template.json"
	 # template_overwrite => "true"
	codec => json

```

could it be correct this?  
what do I have to write in the file? i dont understand  
con you make a little example for my json  
thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 3, 2017, 7:53am UTC](https://discuss.elastic.co/t/mapping-json-with-logstash/106228/4 "2017-11-03T07:53:20Z")

</div>

Sorry, but this is exactly what the blog post you linked to covers. If you don't understand that text and can't ask specific questions I don't think I'm able to help.

---

<div class="post-metadata">

**Author:** ![citanionarrei](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@citanionarrei](https://discuss.elastic.co/u/citanionarrei)\
**Post date:** [November 3, 2017, 7:55am UTC](https://discuss.elastic.co/t/mapping-json-with-logstash/106228/5 "2017-11-03T07:55:07Z")

</div>

ok please  
how i can create template with logstash for my json?  
where i can see an example or find info for it?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2017, 7:55am UTC](https://discuss.elastic.co/t/mapping-json-with-logstash/106228/6 "2017-12-01T07:55:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
