# Multiple Root Element in single line

**URL:** <https://discuss.elastic.co/t/multiple-root-element-in-single-line/212809>\
**Category:** Logstash\
**Created:** [December 23, 2019, 6:08am UTC](https://discuss.elastic.co/t/multiple-root-element-in-single-line/212809 "2019-12-23T06:08:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mancharagopan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mancharagopan/32/60266_2.png) [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\
**Post date:** [December 23, 2019, 6:08am UTC](https://discuss.elastic.co/t/multiple-root-element-in-single-line/212809/1 "2019-12-23T06:08:10Z")

</div>

I need help with splitting multiple root element in single line.  
My data format like this,

`b_rooms_available_and_soldout:[{"b_id":123, "b_blocks":[{...}]},{"b_id":456, "b_blocks":[{...}]}]`

My logstash config is,

```
    filter {

     mutate {
        gsub => [
          "message", '^b_rooms_available_and_soldout:.', '',
          "message", "],$", "",
          "message", " ", ""
          ]
      }

      json {
        source => "message"
        #target => "event"
      }

      split {
        field => "b_blocks"
      }
}

```

It successfully parsing and splitting if there is only one element, but if there is multiple elements it fails. how do i separate them?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 23, 2019, 7:35am UTC](https://discuss.elastic.co/t/multiple-root-element-in-single-line/212809/2 "2019-12-23T07:35:58Z")

</div>

Can you try something like this:

```auto
...

json {
    source => "message"
    target => "event"
}

split {
    field => "event"
}

split {
    field => "[event][b_blocks]"
}

```

---

<div class="post-metadata">

**Author:** ![mancharagopan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mancharagopan/32/60266_2.png) [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\
**Post date:** [December 23, 2019, 7:45am UTC](https://discuss.elastic.co/t/multiple-root-element-in-single-line/212809/3 "2019-12-23T07:45:11Z")

</div>

I ran it,  
I am getting parse error and split error,

```
:exception=>#<LogStash::Json::ParserError: Unexpected character (',' (code 44)): expected a value
 at [Source: (byte[])"{"b_id":50699001,"b_roomtype_id":9,"b_has_room_inventory":1,"b_name":"DeluxeDoubleRoom","b_blocks":[{"b_mealplan_included_name":"breakfast","b_rate_is_cug_business_rate":0,"b_block_id":"50699001_179538328_2_41_0","b_max_persons":2,"b_stay_prices":[{"b_local_price":0,"b_raw_price":"","b_stays":0,"b_price":""},{"b_price":"LKR19,962.80","b_stays":1,"b_raw_price":"19962.80","b_local_price":19962.800363943},{"b_price":"LKR39,925.60","b_local_price":39925.600727886,"b_stays":2,"b_raw_price":"39925.60""[truncated 8154 bytes]; line: 1, column: 5774]>}

[2019-12-23T13:14:18,069][WARN][logstash.filters.split] Only String and Array types are splittable. field:event is of type = NilClass
[2019-12-23T13:14:18,071][WARN][logstash.filters.split] Only String and Array types are splittable. field:[event][b_blocks] is of type = NilClass
```

---

<div class="post-metadata">

**Author:** ![mancharagopan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mancharagopan/32/60266_2.png) [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\
**Post date:** [December 23, 2019, 7:57am UTC](https://discuss.elastic.co/t/multiple-root-element-in-single-line/212809/4 "2019-12-23T07:57:17Z")

</div>

I modified the gsub filter to following and it's working,

```
 mutate {
    gsub => [
      "message", '^b_rooms_available_and_soldout:', '',
      "message", "],$", "]",
      "message", " ", ""
      ]
  }

```

Adding some more json data to confirm.

---

<div class="post-metadata">

**Author:** ![mancharagopan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mancharagopan/32/60266_2.png) [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\
**Post date:** [December 23, 2019, 8:42am UTC](https://discuss.elastic.co/t/multiple-root-element-in-single-line/212809/5 "2019-12-23T08:42:33Z")

</div>

@Christian_Dahlqvist  
Thanks! It’s working perfectly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 20, 2020, 8:42am UTC](https://discuss.elastic.co/t/multiple-root-element-in-single-line/212809/6 "2020-01-20T08:42:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.