# More JSON Fun

**URL:** <https://discuss.elastic.co/t/more-json-fun/105813>\
**Category:** Logstash\
**Created:** [October 30, 2017, 9:35pm UTC](https://discuss.elastic.co/t/more-json-fun/105813 "2017-10-30T21:35:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elaair](https://avatars.discourse-cdn.com/v4/letter/e/6f9a4e/32.png) [@elaair](https://discuss.elastic.co/u/elaair)\
**Post date:** [October 30, 2017, 9:35pm UTC](https://discuss.elastic.co/t/more-json-fun/105813/1 "2017-10-30T21:35:21Z")

</div>

I have managed to get some JSON into a target field in this manner: json { source =\> dataMsg target =\> justJSON }. I do not know how to access the field data to convert certain fields to floats or integers for use in Kibana. I am posting some of the data for reference. Shown below is a redacted out from rubydebug-

"justJSON" =\> [  
[0] {  
"dst\_region" =\> "Washington",  
"file\_path" =\> "",  
"cci" =\> 90,  
"scan\_type" =\> "Ongoing",  
"type" =\> "nspolicy",  
"\_session\_begin" =\> 1,  
"ccl" =\> "excellent",  
"dst\_longitude" =\> -122.1205978394,  
"dst\_latitude" =\> 47.6800994873,  
snip snip snip  
I have tried various combinations of formats with no success . I have pasted my last attempt.  
convert =\> {"[justJSON][src\_latitude]" =\> "float"}  
convert =\> {"[justJSON][dst\_latitude]" =\> "float"}  
convert =\> {"[justJSON][src\_longitude]" =\> "float"}  
convert =\> {"[justJSON][dst\_longitude]" =\> "float"}

add\_field =\> { "src\_geo\_location" =\> "[justJSON][src\_latitude],[justJSON][src\_longitude]" }  
add\_field =\> { "dst\_geo\_location" =\> "[justJSON][dst\_latitude],[justJSON][dst\_longitude]" }

What is the correct way to access the field data?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 31, 2017, 6:12am UTC](https://discuss.elastic.co/t/more-json-fun/105813/2 "2017-10-31T06:12:08Z")

</div>

The problem is that the `justJSON` field is an array. You'll probably want to move the subfields of `[justJSON][0]` into the top level. You can probably do that with a mutate filter's rename option but then you need to enumerate all fields yourself. If the list of interesting fields is dynamic you'll have to ues a ruby filter.

> convert =\> {"[justJSON][src\_latitude]" =\> "float"}  
> convert =\> {"[justJSON][dst\_latitude]" =\> "float"}  
> convert =\> {"[justJSON][src\_longitude]" =\> "float"}  
> convert =\> {"[justJSON][dst\_longitude]" =\> "float"}

Okay, but judging by what you posted at least the dst fields _are_ floats.

> add\_field =\> { "src\_geo\_location" =\> "[justJSON][src\_latitude],[justJSON][src\_longitude]" }  
> add\_field =\> { "dst\_geo\_location" =\> "[justJSON][dst\_latitude],[justJSON][dst\_longitude]" }

You need to use the `%{fieldname}` notation and since `justJSON` is an array the correct way to address the fields would be `[justJSON][0][src_latitude]`.

---

<div class="post-metadata">

**Author:** ![elaair](https://avatars.discourse-cdn.com/v4/letter/e/6f9a4e/32.png) [@elaair](https://discuss.elastic.co/u/elaair)\
**Post date:** [October 31, 2017, 5:55pm UTC](https://discuss.elastic.co/t/more-json-fun/105813/3 "2017-10-31T17:55:31Z")

</div>

Excellent, Thanks. I really need to get training on this..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 28, 2017, 5:56pm UTC](https://discuss.elastic.co/t/more-json-fun/105813/4 "2017-11-28T17:56:04Z")

</div>

Closed on November 28, 2017, 5:56pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.