# Need help Flattening the json array

**URL:** <https://discuss.elastic.co/t/need-help-flattening-the-json-array/128625>\
**Category:** Logstash\
**Created:** [April 19, 2018, 5:18am UTC](https://discuss.elastic.co/t/need-help-flattening-the-json-array/128625 "2018-04-19T05:18:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![karnamonkster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/karnamonkster/32/67266_2.png) [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\
**Post date:** [April 19, 2018, 5:18am UTC](https://discuss.elastic.co/t/need-help-flattening-the-json-array/128625/1 "2018-04-19T05:18:09Z")

</div>

Hi,

I am trying to flatten the following json:

```
{
  "beans" : [ {
"name" : "Hadoop:service=NameNode,name=NameNodeInfo",
"modelerType" : "org.apache.hadoop.hdfs.server.namenode.FSNamesystem",
"Total" : 976194928640,
"UpgradeFinalized" : true,
"ClusterId" : "CID-289afb0c-9775-46d6-8f22-4d147579f2c5",
"Version" : "2.7.3, rbaa91f7c6bc9cb92be5982de4719c1c8af91ccff",
"Used" : 493926221800,
"Free" : 416318701568,
"Safemode" : "",
"NonDfsUsedSpace" : 65950005272,
"PercentUsed" : 50.59709,
"BlockPoolUsedSpace" : 493926221800,
"PercentBlockPoolUsed" : 50.59709,
"PercentRemaining" : 42.647087,
"CacheCapacity" : 0,
"CacheUsed" : 0,
"TotalBlocks" : 1896,
"TotalFiles" : 220,
"NumberOfMissingBlocks" : 0,
"NumberOfMissingBlocksWithReplicationFactorOne" : 0,
"LiveNodes" : "{\"slave2:50010\":{\"infoAddr\":\"10.xxx.xxx.14:50075\",\"infoSecureAddr\":\"10.xxx.xxx.14:0\",\"xferaddr\":\"10.xxx.xxx.14:50010\",\"lastContact\":0,\"usedSpace\":246963131380,\"adminState\":\"In Service\",\"nonDfsUsedSpace\":33589472268,\"capacity\":488097464320,\"numBlocks\":1896,\"version\":\"2.7.3\",\"used\":246963131380,\"remaining\":207544860672,\"blockScheduled\":0,\"blockPoolUsed\":246963131380,\"blockPoolUsedPercent\":50.597095,\"volfails\":0},\"slave1:50010\":{\"infoAddr\":\"10.xxx.xxx.12:50075\",\"infoSecureAddr\":\"10.xxx.xxx.12:0\",\"xferaddr\":\"10.xxx.xxx.12:50010\",\"lastContact\":0,\"usedSpace\":246963090420,\"adminState\":\"In Service\",\"nonDfsUsedSpace\":32360533004,\"capacity\":488097464320,\"numBlocks\":1896,\"version\":\"2.7.3\",\"used\":246963090420,\"remaining\":208773840896,\"blockScheduled\":0,\"blockPoolUsed\":246963090420,\"blockPoolUsedPercent\":50.597088,\"volfails\":0}}",
"DeadNodes" : "{}",
"DecomNodes" : "{}",
"BlockPoolId" : "BP-484138619-10.xxx.xxx.10-1482316479215",
"NameDirStatuses" : "{\"active\":{\"/srv/hadoop/tmp/dfs/name\":\"IMAGE_AND_EDITS\"},\"failed\":{}}",
"NodeUsage" : "{\"nodeUsage\":{\"min\":\"50.60%\",\"median\":\"50.60%\",\"max\":\"50.60%\",\"stdDev\":\"0.00%\"}}",
"NameJournalStatus" : "[{\"manager\":\"FileJournalManager(root=/srv/hadoop/tmp/dfs/name)\",\"stream\":\"EditLogFileOutputStream(/srv/hadoop/tmp/dfs/name/current/edits_inprogress_0000000000012297436)\",\"disabled\":\"false\",\"required\":\"false\"}]",
"JournalTransactionInfo" : "{\"MostRecentCheckpointTxId\":\"12297435\",\"LastAppliedOrWrittenTxId\":\"12299635\"}",
"NNStarted" : "Mon Apr 16 07:05:30 GST 2018",
"CompileInfo" : "2016-08-18T01:41Z by root from branch-2.7.3",
"CorruptFiles" : "[]",
"DistinctVersionCount" : 1,
"DistinctVersions" : [ {
  "key" : "2.7.3",
  "value" : 2
} ],
"SoftwareVersion" : "2.7.3",
"RollingUpgradeStatus" : null,
"Threads" : 34
  } ]
}

```

Could someone help me with the same.  
I tried with the split filter configuration but could only reach till here -

 ![jmx_json](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3e403e9f849b477fb120263453ecdb5592dfa12a.PNG)

Suggestions to get the complete array parsed.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 19, 2018, 6:37am UTC](https://discuss.elastic.co/t/need-help-flattening-the-json-array/128625/2 "2018-04-19T06:37:08Z")

</div>

You have a number of fields that contain JSON strings. Parse them with a json filter.

---

<div class="post-metadata">

**Author:** ![karnamonkster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/karnamonkster/32/67266_2.png) [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\
**Post date:** [April 22, 2018, 9:35am UTC](https://discuss.elastic.co/t/need-help-flattening-the-json-array/128625/3 "2018-04-22T09:35:59Z")

</div>

Hi Magnus,

Here is the filter configuration

```
filter {
json {
    source => "message"
    target => "message"
  }
  split {
field => "[beans]"
target => "beans"
   }
}

```

How do i apply the filter for the fields that are not parsed?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 23, 2018, 7:18am UTC](https://discuss.elastic.co/t/need-help-flattening-the-json-array/128625/4 "2018-04-23T07:18:50Z")

</div>

You just use the json filter in the same way as above but choose different field names.

---

<div class="post-metadata">

**Author:** ![karnamonkster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/karnamonkster/32/67266_2.png) [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\
**Post date:** [April 23, 2018, 10:23am UTC](https://discuss.elastic.co/t/need-help-flattening-the-json-array/128625/5 "2018-04-23T10:23:36Z")

</div>

Perfect!! Thanks so much Magnus, guess i hesitated to go one step further 😄

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2018, 10:23am UTC](https://discuss.elastic.co/t/need-help-flattening-the-json-array/128625/6 "2018-05-21T10:23:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.