# Need to parse josn object
**URL:** https://discuss.elastic.co/t/need-to-parse-josn-object/144455
**Category:** Logstash
**Created:** [August 15, 2018, 6:02am UTC](https://discuss.elastic.co/t/need-to-parse-josn-object/144455 "2018-08-15T06:02:30Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Charan\_Adabala](https://discuss.elastic.co/u/Charan_Adabala)
#### Post date: [August 15, 2018, 6:02am UTC](https://discuss.elastic.co/t/need-to-parse-josn-object/144455/1 "2018-08-15T06:02:31Z")
Hi,
I need to parse this json object using logstash can you please any one help me:
Sample Event:
{"result":{"points":{"HOST-B765":[[1531504800000,84.54410552978516],[1531526400000,99.29006958007812]]},"unit":"Percent (%)","aggregationType":"MAX","resolutionInMillisUTC":21600000,"timeseriesId":"com.apple.builtin:host.cpu.idle","entities":{"HOST-B765":"apple"}}}
Desired output:
{"timestamp":"1531504800000","value":"84.54410552978516","unit":"Percent (%)","aggregationType":"MAX","resolutionInMillisUTC":21600000,"timeseriesId":"com.apple.builtin:host.cpu.idle","hostId":"HOST-B765","servername":"apple"}
{"timestamp":"1531526400000","value":"99.29006958007812","unit":"Percent (%)","aggregationType":"MAX","resolutionInMillisUTC":21600000,"timeseriesId":"com.apple.builtin:host.cpu.idle","hostId":"HOST-B765","servername":"apple"}
Can you please help me please.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 15, 2018, 6:22am UTC](https://discuss.elastic.co/t/need-to-parse-josn-object/144455/2 "2018-08-15T06:22:15Z")
This isn't a JSON parsing problem.
The general way to split an event into multiple events is to use a split filter. You could use such a filter on the `[result][points][HOST-B765]` field to perform the split, after which you'd want to do some additional mutations to get the events exactly as you want them, but a complicating factor is, I guess, that the HOST-B765 string in your example is dynamic. In that case you'll have to use a ruby filter to rearrange the fields so that the array you want to split on is stored in a field with a fixed name.
---
### Author:  [@Charan\_Adabala](https://discuss.elastic.co/u/Charan_Adabala)
#### Post date: [August 15, 2018, 7:44am UTC](https://discuss.elastic.co/t/need-to-parse-josn-object/144455/3 "2018-08-15T07:44:36Z")
I have this "[1531504800000,84.54410552978516]"
Key is : 1531504800000
value is : 84.54410552978516
How can i parse this ? can you please
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 15, 2018, 8:05am UTC](https://discuss.elastic.co/t/need-to-parse-josn-object/144455/4 "2018-08-15T08:05:29Z")
Please show what the Logstash event current looks like (use a `stdout { codec => rubydebug }` output to dump the raw event or copy/paste from Kibana's JSON tab) and what you'd like it to look like instead.
---
### Author:  [@Charan\_Adabala](https://discuss.elastic.co/u/Charan_Adabala)
#### Post date: [August 15, 2018, 8:12am UTC](https://discuss.elastic.co/t/need-to-parse-josn-object/144455/5 "2018-08-15T08:12:46Z")
```
{
"result" => {
"unit" => "Percent (%)",
"timeseriesId" => "com.apple.builtin:host.cpu.idle",
"points" => {
"HOST-B89765" => [
[0] [
[0] 1531504800000,
[1] 84.54410552978516
],
[1] [
[0] 1531526400000,
[1] 99.29006958007812
]
},
"aggregationType" => "MAX",
"resolutionInMillisUTC" => 21600000,
"entities" => {
"HOST-B89765" => "apple"
}
},
"@version" => "1",
"host" => "Jayram-PC",
"@timestamp" => 2018-08-15T08:08:28.153Z,
"path" => "D:/logstash/logstash-6.2.4/input/Sample.json"
```
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 15, 2018, 9:15am UTC](https://discuss.elastic.co/t/need-to-parse-josn-object/144455/6 "2018-08-15T09:15:56Z")
Okay, but that looks like what you posted from the start. I've already outlined how I think you should solve the problem. I can answer specific questions about that but I don't have time to write at working example.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 12, 2018, 9:22am UTC](https://discuss.elastic.co/t/need-to-parse-josn-object/144455/7 "2018-09-12T09:22:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.