# Need help parsing json array

**URL:** <https://discuss.elastic.co/t/need-help-parsing-json-array/133576>\
**Category:** Logstash\
**Created:** [May 28, 2018, 5:29pm UTC](https://discuss.elastic.co/t/need-help-parsing-json-array/133576 "2018-05-28T17:29:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vcn](https://avatars.discourse-cdn.com/v4/letter/v/c57346/32.png) [@vcn](https://discuss.elastic.co/u/vcn)\
**Post date:** [May 28, 2018, 5:29pm UTC](https://discuss.elastic.co/t/need-help-parsing-json-array/133576/1 "2018-05-28T17:29:43Z")

</div>

Hello everyone,

I need help with parsing some Logstash logs.

**Incoming JSON :**

```
{
	"data1": {
		"propriety_Version": "1.0",
		"source": "onetwothree"
	},
	"parent": {
		"parentname": "valuezxz",
		  "childArray": [{
			"childname": "john",
			"boolean": false
		  }, {
			"childname": "bob",
			"boolean": true
		 }]
	}
}

```

**Filter**

filter {  
split {  
field =\> "[parent][childArray]"  
}  
}

**Output** : None, it's stuck in the splitting, I added a if childArray !=[] in case I had parent with no child, but it doesn't help much. No error message with output rubydebug.

I've only managed to make this work if the parent only has 1 child, but the moment I have multiple child, the filter doesn't work.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 28, 2018, 7:55pm UTC](https://discuss.elastic.co/t/need-help-parsing-json-array/133576/2 "2018-05-28T19:55:44Z")

</div>

We cannot help you if you do not tell us what you are doing. That "JSON" is not valid JSON, in several ways. What does the input actually look like? Are you using a JSON codec on an input or a JSON filter.

In principal, the split is just fine, so I don't think you have an array field on your event called [parent][childArray].

For example, this will produce two events, one for john and one for bob.

```auto
input {
    generator { 
        codec => "json"
        message => '{ "data1": { "propriety_Version": "1.0", "source": "onetwothree" }, "parent": { "parentname": "valuezxz", "childArray": [{ "childname": "john", "boolean": false }, { "childname": "bob", "boolean": true }] } }' 
        count => 1 
    }
}
output { stdout { codec => rubydebug } }
filter { split { field => "[parent][childArray]" } }

```

---

<div class="post-metadata">

**Author:** ![vcn](https://avatars.discourse-cdn.com/v4/letter/v/c57346/32.png) [@vcn](https://discuss.elastic.co/u/vcn)\
**Post date:** [May 29, 2018, 4:38pm UTC](https://discuss.elastic.co/t/need-help-parsing-json-array/133576/3 "2018-05-29T16:38:18Z")

</div>

Hi Badger,

Thanks, I managed to the split part, you were right about it working correctly. The issue I ran into was trying to parse some parent with no child(which I didn't knew existed).

The ouput is good but if I may add a following question,

How should I proceed to recreate 1 document per child? Something like this

```
{
	"data1": {
		"propriety_Version": "1.0",
		"source": "onetwothree"
	},
	"parent": {
		"parentname": "valuezxz",
		  "childArray": [{
			"childname": "john",
			"boolean": false
		  }]
	}
}

{
	"data1": {
		"propriety_Version": "1.0",
		"source": "onetwothree"
	},
	"parent": {
		"parentname": "valuezxz",
		  "childArray": [{
			"childname": "bob",
			"boolean": true
		 }]
	}
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 29, 2018, 4:49pm UTC](https://discuss.elastic.co/t/need-help-parsing-json-array/133576/4 "2018-05-29T16:49:04Z")

</div>

I am not sure I understand the question. Are you saying that after splitting the array childArray you want to coerce it back to being an array with a single member? You could do that using a ruby filter.

```auto
    split { field => "[parent][childArray]" }
    ruby {
        code => '
            a = []
            a << event.get("[parent][childArray]")
            event.set("[parent][childArray]", a)
        '
    }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2018, 4:49pm UTC](https://discuss.elastic.co/t/need-help-parsing-json-array/133576/5 "2018-06-26T16:49:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.