# Merge separate json objects output to an array

**URL:** https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393
**Category:** Logstash
**Created:** [April 17, 2018, 3:33pm UTC](https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393 "2018-04-17T15:33:35Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![SKing](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@SKing](https://discuss.elastic.co/u/SKing)
#### Post date: [April 17, 2018, 3:33pm UTC](https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393/1 "2018-04-17T15:33:35Z")

</div>

I am querying an elastic search instance.

I end up with a series of json objects.

```
{"business_id": "1",
 "Accepts Credit Cards": true,
 "Price Range": 1,
 "type": "food"}
{"business_id": "2",
 "Accepts Credit Cards": true,
 "Price Range": 2,
 "type": "cloth"}
{"business_id": "3",
 "Accepts Credit Cards": false,
 "Price Range": 3,
 "type": "sports"}

```

On using the the json codec format, it remains as a list of separate json objects.

I want to finish with an array of json objects instead.

{"some\_name": [ {"business\_id": "1",  
"Accepts Credit Cards": true,  
"Price Range": 1,  
"type": "food"}  
{"business\_id": "2",  
"Accepts Credit Cards": true,  
"Price Range": 2,  
"type": "cloth"}  
{"business\_id": "3",  
"Accepts Credit Cards": false,  
"Price Range": 3,  
"type": "sports"}]}

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 17, 2018, 3:51pm UTC](https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393/2 "2018-04-17T15:51:04Z")

</div>

Are these separate documents, or multiple objects in the same document?

---

<div class="post-metadata">

### Author: ![SKing](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@SKing](https://discuss.elastic.co/u/SKing)
#### Post date: [April 18, 2018, 8:42am UTC](https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393/3 "2018-04-18T08:42:07Z")

</div>

Multiple objects in the same document.

I'm guessing that one would use filter -\> aggregate for this?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 18, 2018, 1:32pm UTC](https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393/4 "2018-04-18T13:32:43Z")

</div>

It might be easier to do it using ruby. Is there any way you can show us an example document? Either from stdout { codec =\> rubydebug } or from the JSON from Discover in Kibana.

---

<div class="post-metadata">

### Author: ![SKing](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@SKing](https://discuss.elastic.co/u/SKing)
#### Post date: [April 19, 2018, 8:59am UTC](https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393/5 "2018-04-19T08:59:41Z")

</div>

File is as posted above  
Seperate java objects  
{"id":"123", "array1":["val1", "val2"], "array2":["val3", "val4"]}  
{"id":"234", "array1":["val11", "val22"], "array2":["val3", "val4"]}  
{"id":"345", "array1":["val71", "val22"], "array2":["val3", "val4"]}  
and instead I want to have an array of objects  
{"name1": [{"id":"123", "array1":["val1", "val2"], "array2":["val3", "val4"]},  
{"id":"234", "array1":["val11", "val22"], "array2":["val3", "val4"]},  
{"id":"345", "array1":["val71", "val22"], "array2":["val3", "val4"]}]}

What I have tried

1. include a new name-value pair with the same value  
{"index":"sw", "id":"123", "array1":["val1", "val2"], "array2":["val3", "val4"]}  
{"index":"sw","id":"234", "array1":["val11", "val22"], "array2":["val3", "val4"]}  
{"index":"sw","id":"345", "array1":["val71", "val22"], "array2":["val3", "val4"]}  
then try and aggregate on this  
filter {  
....  
mutate {  
aggregate =\> {  
task\_id =\> %{index}  
map['id'] =\> event.get('id')  
map['array1'] =\> event.get('array1')  
map['array2'] =\> event.get('array2')  
}  
}  
....  
}

but am getting an error.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 20, 2018, 1:01am UTC](https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393/6 "2018-04-20T01:01:07Z")

</div>

> [@SKing](#):
>
> but am getting an error

I am unable to determine what error you are getting.

---

<div class="post-metadata">

### Author: ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 20, 2018, 7:34am UTC](https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393/7 "2018-04-20T07:34:29Z")

</div>

If I understand that right, you put an aggregate filter inside of a mutate filter and the did not wrap the code for the aggregation in code =\> "". It looks pretty chaotic, to be honest...

---

<div class="post-metadata">

### Author: ![SKing](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@SKing](https://discuss.elastic.co/u/SKing)
#### Post date: [April 20, 2018, 9:20am UTC](https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393/8 "2018-04-20T09:20:51Z")

</div>

Yes, thanks Badge and Jenni fro replying.

On review, I think that I am misusing/abusing logstash. Logstash is for streams of data, hence why I'm getting a series of json objects.

I shouldn't trying to do what I'm doing as I'm trying to take ALL of my logstash events and put them in a json string. Which goes against the logstash use of data streams.

Thanks for the replies.  
Mods - you can close this now if you wish.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 18, 2018, 9:21am UTC](https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393/9 "2018-05-18T09:21:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
