# Need help in removing mysql field name for logstash elastic search json output

**URL:** <https://discuss.elastic.co/t/need-help-in-removing-mysql-field-name-for-logstash-elastic-search-json-output/87126>\
**Category:** Logstash\
**Created:** [May 25, 2017, 1:04pm UTC](https://discuss.elastic.co/t/need-help-in-removing-mysql-field-name-for-logstash-elastic-search-json-output/87126 "2017-05-25T13:04:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashish\_pandey](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@ashish\_pandey](https://discuss.elastic.co/u/ashish_pandey)\
**Post date:** [May 25, 2017, 1:04pm UTC](https://discuss.elastic.co/t/need-help-in-removing-mysql-field-name-for-logstash-elastic-search-json-output/87126/1 "2017-05-25T13:04:27Z")

</div>

Hi,  
I want to change the mysql fields id, project, key\_type, data, created\_at into a json without field name.  
Mysql Values are id: 1, project: slug1, key\_type: slug2, data: {"key1": "value1", "key2": "value2"}, created\_at: 2017-05-25 18:06:24

I want below Json output that will be indexed into Elastic search :  
{  
"id":1,  
"project": "slug1",  
"key\_type": "slug2",  
"key1": "value1",  
"key2": "value2",  
"created\_at": "2017-05-25 18:06:24"  
}

My logstash.conf file is :  
input {  
jdbc {  
jdbc\_connection\_string =\> "jdbc:mysql://localhost:3306/testdb?autoReconnect=true&useSSL=false"  
jdbc\_user =\> "root"  
jdbc\_password =\> ""  
jdbc\_driver\_library =\> "/Users/ashishkumar.p/Downloads/mysql-connector-java-5.1.42/mysql-connector-java-5.1.42-bin.jar"  
jdbc\_driver\_class =\> "com.mysql.jdbc.Driver"  
statement =\> "SELECT \* from testtable"  
}  
}  
output {  
stdout { codec =\> json\_lines }  
elasticsearch{  
"hosts" =\> "192.168.0.100:9200"  
"index" =\> "test.migrate"  
"document\_type" =\> "data"  
"document\_id" =\> "%{uid}"  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 29, 2017, 6:37pm UTC](https://discuss.elastic.co/t/need-help-in-removing-mysql-field-name-for-logstash-elastic-search-json-output/87126/2 "2017-05-29T18:37:27Z")

</div>

Does the `data` column contain the JSON string '{"key1": "value1", "key2": "value2"}' or what do you mean? To avoid ambiguity I suggest you post exactly what you're currently getting into Elasticsearch (use copy/paste).

---

<div class="post-metadata">

**Author:** ![ashish\_pandey](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@ashish\_pandey](https://discuss.elastic.co/u/ashish_pandey)\
**Post date:** [June 2, 2017, 6:22am UTC](https://discuss.elastic.co/t/need-help-in-removing-mysql-field-name-for-logstash-elastic-search-json-output/87126/3 "2017-06-02T06:22:47Z")

</div>

Yes, data column contains the json String. Right now i am getting data in Elasticsearch as below  
{  
"id":1,  
"project": "slug1",  
"key\_type": "slug2",  
"data": '{"key1": "value1", "key2": "value2"}',  
"created\_at": "2017-05-25 18:06:24"  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 2, 2017, 6:24am UTC](https://discuss.elastic.co/t/need-help-in-removing-mysql-field-name-for-logstash-elastic-search-json-output/87126/4 "2017-06-02T06:24:38Z")

</div>

What you posted isn't valid JSON so it's still not clear exactly what you have, but you can use the json filter to parse JSON strings that are stored in fields.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2017, 6:25am UTC](https://discuss.elastic.co/t/need-help-in-removing-mysql-field-name-for-logstash-elastic-search-json-output/87126/5 "2017-06-30T06:25:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.