# Metricbeat http module nested json

**URL:** <https://discuss.elastic.co/t/metricbeat-http-module-nested-json/278452>\
**Category:** Elasticsearch\
**Created:** [July 12, 2021, 6:00pm UTC](https://discuss.elastic.co/t/metricbeat-http-module-nested-json/278452 "2021-07-12T18:00:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![creativeguitar](https://avatars.discourse-cdn.com/v4/letter/c/ce73a5/32.png) [@creativeguitar](https://discuss.elastic.co/u/creativeguitar)\
**Post date:** [July 12, 2021, 6:00pm UTC](https://discuss.elastic.co/t/metricbeat-http-module-nested-json/278452/1 "2021-07-12T18:00:15Z")

</div>

I need help regarding elastic search mapping of nested json response. I am using the meatricbeat's http module to query data from our asset management system and I am getting the following response in return

```auto
"fields": [
          {
            "displayName": "IT Vertical",
            "value": "Data Analytics"
          },
          {
            "displayName": "Serial Number",
            "value": "VMware-XXXXXXXXXXXX"            
          },
          {
            "displayName": "System Name",
            "value": "Test-Virtual-Machine"
          }
]

```

Based on what I found on google, it looks like this is a nested json response where the "key" is the value for "displayName" and the "value" is the value of the value field. for example:

```auto
----Key---------------value----------
IT Vertical-------Data Analytics
Serial Number-----VMware-XXXXXXXXXXXX
System Name-------Test-Virtual-Machine

```

I am able to use processors inside the http module and ideally i would like to shape the data before it gets to logstash/elasticsearch. but if it is not possible, is it possible to modify this data accordingly by using ingest node pipelines? if so, any ideas how? any other responses are welcomed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2021, 6:00pm UTC](https://discuss.elastic.co/t/metricbeat-http-module-nested-json/278452/2 "2021-08-09T18:00:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.