# Merge Several json parsed fields to 1 field

**URL:** <https://discuss.elastic.co/t/merge-several-json-parsed-fields-to-1-field/52065>\
**Category:** Logstash\
**Created:** [June 7, 2016, 12:05pm UTC](https://discuss.elastic.co/t/merge-several-json-parsed-fields-to-1-field/52065 "2016-06-07T12:05:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wesley\_Smekens](https://avatars.discourse-cdn.com/v4/letter/w/dc4da7/32.png) [@Wesley\_Smekens](https://discuss.elastic.co/u/Wesley_Smekens)\
**Post date:** [June 7, 2016, 12:05pm UTC](https://discuss.elastic.co/t/merge-several-json-parsed-fields-to-1-field/52065/1 "2016-06-07T12:05:08Z")

</div>

Hey All,

Part of our logs we recieve are in json format.  
I filter out these messages with following filter:

json {  
source =\> "Request"  
target =\> "Request\_parsed"  
}

This works perfectly and we are getting a lot of Request\_parsed.\*\*\* fields.  
Now I want to merge part of these fields to a new field called Comment so i can use 1 field in kibana to show all the requests.

is this possible in logstash?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 10, 2016, 5:36am UTC](https://discuss.elastic.co/t/merge-several-json-parsed-fields-to-1-field/52065/2 "2016-06-10T05:36:32Z")

</div>

```nohighlight
filter {
  mutate {
    add_field => {
      "merged_field" => "%{[Request_parsed][subfield1]} %{[Request_parsed][subfield2]}"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Wesley\_Smekens](https://avatars.discourse-cdn.com/v4/letter/w/dc4da7/32.png) [@Wesley\_Smekens](https://discuss.elastic.co/u/Wesley_Smekens)\
**Post date:** [June 10, 2016, 12:15pm UTC](https://discuss.elastic.co/t/merge-several-json-parsed-fields-to-1-field/52065/3 "2016-06-10T12:15:03Z")

</div>

ok got this:

`mutate { add_field => { "Comment" => "%{[Request_parsed][type_label]} %{[Request_parsed][canonical_type_label]} %{[Request_parsed][title]}" %{[Request_parsed][value_label]}" }`

The problem now is that not every field get's data and i get this in kibana:

June 10th 2016, 14:06:58.308%{[Request\_parsed][type\_label]} Disease %{[Request\_parsed][title]} %{[Request\_parsed][value\_label]}

June 10th 2016, 14:06:51.362%{[Request\_parsed][type\_label]} %{[Request\_parsed][canonical\_type\_label]} Combined immunodeficiency due to OX40 deficiency %{[Request\_parsed][value\_label]}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 10, 2016, 7:37pm UTC](https://discuss.elastic.co/t/merge-several-json-parsed-fields-to-1-field/52065/4 "2016-06-10T19:37:20Z")

</div>

Wrap the mutate filter in a conditional.

```nohighlight
if [Request_parsed][type_label] {
  mutate {
    add_field => {
      "Comment" => "%{[Request_parsed][type_label]}"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Wesley\_Smekens](https://avatars.discourse-cdn.com/v4/letter/w/dc4da7/32.png) [@Wesley\_Smekens](https://discuss.elastic.co/u/Wesley_Smekens)\
**Post date:** [June 13, 2016, 8:18am UTC](https://discuss.elastic.co/t/merge-several-json-parsed-fields-to-1-field/52065/5 "2016-06-13T08:18:41Z")

</div>

thanks, works like a charm

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/merge-several-json-parsed-fields-to-1-field/52065/6 "2017-07-06T04:53:24Z")

</div>