# Need help on to extact JSON data from filed and send as multiple events
**URL:** https://discuss.elastic.co/t/need-help-on-to-extact-json-data-from-filed-and-send-as-multiple-events/130755
**Category:** Logstash
**Created:** [May 6, 2018, 4:03pm UTC](https://discuss.elastic.co/t/need-help-on-to-extact-json-data-from-filed-and-send-as-multiple-events/130755 "2018-05-06T16:03:09Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ssuccess2003](https://discuss.elastic.co/u/ssuccess2003)
#### Post date: [May 6, 2018, 4:03pm UTC](https://discuss.elastic.co/t/need-help-on-to-extact-json-data-from-filed-and-send-as-multiple-events/130755/1 "2018-05-06T16:03:10Z")
Hi Team,
I need help on the below requirement. I have developed a custome beat which stores powershell JSON output in a string field and send it to log stash. I want to extract this stringified JSON and send it as seperate events.
Powershell JSON output which i store it in a string field and publish the event(via beats)
[{
"Name": "\_\_GENUS",
"Value": 2,
"Type": 3,
"IsLocal": true,
"IsArray": false,
"Origin": "\_\_\_SYSTEM",
"Qualifiers": ""
},
{
"Name": "\_\_CLASS",
"Value": "Win32\_Processor",
"Type": 8,
"IsLocal": true,
"IsArray": false,
"Origin": "\_\_\_SYSTEM",
"Qualifiers": ""
}]
Beats Output to logstash as below:
{
"\_index": "logstash-2018.05.06",
"\_type": "doc",
"\_id": "lqcsNmMBKmiJGSDBbfkb",
"\_version": 1,
"\_score": null,
"\_source": {
"JDATA": "[{\r\n "Name": "\_\_GENUS",\r\n "Value": 2,\r\n "Type": 3,\r\n "IsLocal": true,\r\n "IsArray": false,\r\n "Origin": "\_\_\_SYSTEM",\r\n "Qualifiers": ""\r\n},\r\n{\r\n "Name": "\_\_CLASS",\r\n "Value": "Win32\_Processor",\r\n "Type": 8,\r\n "IsLocal": true,\r\n "IsArray": false,\r\n "Origin": "\_\_\_SYSTEM",\r\n "Qualifiers": ""\r\n}]",
"type": "DESKTOP-75FCJS8",
"@version": "1",
"counter": 41,
"beat": {
"name": "DESKTOP-75FCJS8",
"hostname": "DESKTOP-75FCJS8",
"version": "7.0.0-alpha1"
},
"tags": [
"beats\_input\_raw\_event"
],
"@timestamp": "2018-05-06T15:57:50.104Z",
"host": "DESKTOP-75FCJS8"
},
"fields": {
"@timestamp": [
"2018-05-06T15:57:50.104Z"
]
},
"sort": [
1525622270104
]
}
My requirement is mentioned below:
i need extract json from JDATA field, split it and send it as seperate events(event1, event2)
i want output of logstash to send it to elastic search should be as below:
event 1:
{
"Name": "\_\_GENUS",
"Value": 2,
"Type": 3,
"IsLocal": true,
"IsArray": false,
"Origin": "\_\_\_SYSTEM",
"Qualifiers": ""
}
event 2:
{
"Name": "\_\_CLASS",
"Value": "Win32\_Processor",
"Type": 8,
"IsLocal": true,
"IsArray": false,
"Origin": "\_\_\_SYSTEM",
"Qualifiers": ""
}
Please help how to achieve this requirement.
---
### Author:  [@counterf](https://discuss.elastic.co/u/counterf)
#### Post date: [May 6, 2018, 5:38pm UTC](https://discuss.elastic.co/t/need-help-on-to-extact-json-data-from-filed-and-send-as-multiple-events/130755/2 "2018-05-06T17:38:23Z")
You need to use mutate to do this, I think.
JDATA is an array. To copy the data from the array you need to do something like this:
```
mutate {
copy => { "[JDATA][0][Name]" => "JDATA_NAME"}
copy => { "[JDATA][0][Value]" => "JDATA_VALUE"}
copy => { "[JDATA][0][Type]" => "JDATA_TYPE"}
copy => { "[JDATA][0].....
}
```
I am not sure if you need to keep [0] or change accordingly. Just try.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 7, 2018, 11:05am UTC](https://discuss.elastic.co/t/need-help-on-to-extact-json-data-from-filed-and-send-as-multiple-events/130755/3 "2018-05-07T11:05:02Z")
Ues a json filter to parse the JSON string in the `JDATA` field, then use a split filter to split the resulting array field into multiple events.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 4, 2018, 11:05am UTC](https://discuss.elastic.co/t/need-help-on-to-extact-json-data-from-filed-and-send-as-multiple-events/130755/4 "2018-06-04T11:05:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.