# Need to Extract field **URL:** \ **Category:** Logstash\ **Tags:** windows\ **Created:** [February 14, 2022, 2:37pm UTC](https://discuss.elastic.co/t/need-to-extract-field/297154 "2022-02-14T14:37:29Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![SRIGURU\_VEL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sriguru_vel/32/88656_2.png) [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Post date:** [February 14, 2022, 2:37pm UTC](https://discuss.elastic.co/t/need-to-extract-field/297154/1 "2022-02-14T14:37:29Z")
Hi Experts, I am using logstash 7.9.3 and i have written the MongoDb connection with Elasticsearch pipeline. Data's are perfectly pushed into Elasticsearch. In that index I need to split one field. My logstash configuration is:- > input { > mongodb{ > uri =\> 'mongodb://127.0.0.1:27017/testDb' > placeholder\_db\_dir =\> 'C:\Data\db' > placeholder\_db\_name =\> 'test.db' > collection =\> 'testmeachine' > batch\_size =\> 10 > parse\_method =\> "simple" > } > } > filter{ > mutate { > copy =\> { "\_id" =\> "[@metadata][\_id]"} > remove\_field =\> ["\_id"] > } > mutate { > copy =\> { "userId" =\> "[@metadata][userId]"} > remove\_field =\> ["userId"] > } > mutate { > copy =\> { "formId" =\> "[@metadata][formId]"} > remove\_field =\> ["formId"] > } > } > output { > elasticsearch { > action =\> "index" > index =\> "mongo01test" > hosts =\> "[http://localhost:9200](http://localhost:9200)" > } > stdout{ > codec =\> rubydebug > } > } Here is the sample field need to change:- > "afterValue" : """{"orderno"=\>104, "amount"=\>12031, "Save and Close"=\>false, "Approved"=\>false, "Rejected"=\>true}""", Thanks and Advance, Sriguruvel. ---
**Author:** ![SRIGURU\_VEL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sriguru_vel/32/88656_2.png) [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Post date:** [February 15, 2022, 12:35pm UTC](https://discuss.elastic.co/t/need-to-extract-field/297154/2 "2022-02-15T12:35:13Z")
HI experts, Need help. Thanks , Sriguruvel. ---
**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Post date:** [February 15, 2022, 5:37pm UTC](https://discuss.elastic.co/t/need-to-extract-field/297154/3 "2022-02-15T17:37:04Z")
> [@SRIGURU\_VEL](#): > > Here is the sample field need to change:- > > > "afterValue" : """{"orderno"=\>104, "amount"=\>12031, "Save and Close"=\>false, "Approved"=\>false, "Rejected"=\>true}""", If you want some advice, you need to elaborate what change you want. ---
**Author:** ![SRIGURU\_VEL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sriguru_vel/32/88656_2.png) [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Post date:** [February 16, 2022, 7:07am UTC](https://discuss.elastic.co/t/need-to-extract-field/297154/4 "2022-02-16T07:07:15Z")
Hi @Tomo_M , This is my logstash.conf file:- ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/a/4a0aa7ecec760890c60d1487e271827a92f2b79d.png) Here is my Mongo DB data ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/e/ee051c4d7e6c810b325adfa12da01c967519fed7.png) Here is the output of logstash:- ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/c/0cef518ef3fc81cd1ea6d7e2e891a4da29d9b11f.png) Here is my Elasticsearch Output:- ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/9/692640b5af38315eedfb86b9254848f09d939d5f.png) Some of my data are pushed look like a message field . for example there is a beforeValue field , i need that contant as an array. Thanks in advance, Sriguruvel. ---
**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Post date:** [February 16, 2022, 7:43am UTC](https://discuss.elastic.co/t/need-to-extract-field/297154/5 "2022-02-16T07:43:34Z")
Please not paste screenshots but use `` to preformat texts. Texts could copy and seachable. I'm not familiar with MongoDB input plugin, but is there no option about parsing object fields? Though I'm not sure what you exactly mean by "split" the field, [JSON filter plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html) can parse JSON string field to some object or array. ---
**Author:** ![SRIGURU\_VEL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sriguru_vel/32/88656_2.png) [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Post date:** [February 16, 2022, 8:22am UTC](https://discuss.elastic.co/t/need-to-extract-field/297154/6 "2022-02-16T08:22:34Z")
Hi @Tomo_M , sorry for that . I will try JSON filter plugin. Thanks, Sriguruvel. ---
**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Post date:** [February 16, 2022, 8:58am UTC](https://discuss.elastic.co/t/need-to-extract-field/297154/7 "2022-02-16T08:58:33Z")
> [@Tomo\_M](#): > > is there no option about parsing object fields? And also please check the mongoDB input plugin's document. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 16, 2022, 6:36pm UTC](https://discuss.elastic.co/t/need-to-extract-field/297154/8 "2022-02-16T18:36:23Z")
> [@SRIGURU\_VEL](#): > > parse\_method =\> "simple" I suspect this is your problem. Go read the [source](https://github.com/phutchins/logstash-input-mongodb/blob/master/lib/logstash/inputs/mongodb.rb) and see if flatten or dig would work better for your use case. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 16, 2022, 6:36pm UTC](https://discuss.elastic.co/t/need-to-extract-field/297154/9 "2022-03-16T18:36:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.