# Nested array in json
**URL:** https://discuss.elastic.co/t/nested-array-in-json/41694
**Category:** Logstash
**Created:** [February 13, 2016, 7:22pm UTC](https://discuss.elastic.co/t/nested-array-in-json/41694 "2016-02-13T19:22:32Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@logstash\_oz](https://discuss.elastic.co/u/logstash_oz)
#### Post date: [February 13, 2016, 7:22pm UTC](https://discuss.elastic.co/t/nested-array-in-json/41694/1 "2016-02-13T19:22:32Z")
Hi, Does ELK solve the problem of parsing nested arrays in json?
I spent a day or two to test graylog and it failed. Also came across another drawback in graylog(it does not handle "" well. Seems there is no other tool that parses nested json. Our logs are highly nested, the only tools I found were as expensive as splunk(Loggly, Sumologic) Any suggestions?
---
### Author:  [@cstrzadala](https://discuss.elastic.co/u/cstrzadala)
#### Post date: [February 15, 2016, 6:18am UTC](https://discuss.elastic.co/t/nested-array-in-json/41694/2 "2016-02-15T06:18:09Z")
Hi,
A good start into Elasticsearch is [https://www.elastic.co/guide/en/elasticsearch/guide/current/intro.html](https://www.elastic.co/guide/en/elasticsearch/guide/current/intro.html)
If you want to parse specifically, you should look at Logstash [https://www.elastic.co/guide/en/logstash/current/index.html](https://www.elastic.co/guide/en/logstash/current/index.html)
---
### Author:  [@logstash\_oz](https://discuss.elastic.co/u/logstash_oz)
#### Post date: [February 16, 2016, 5:03am UTC](https://discuss.elastic.co/t/nested-array-in-json/41694/3 "2016-02-16T05:03:59Z")
Will it parse nested arrays?. I installed ELK and was able to load data , but it did not parse the nested json. Is that a known limitation, kindly advice?
Thanks
Tushar
---
### Author:  [@cstrzadala](https://discuss.elastic.co/u/cstrzadala)
#### Post date: [February 16, 2016, 6:38am UTC](https://discuss.elastic.co/t/nested-array-in-json/41694/4 "2016-02-16T06:38:21Z")
Hi,
I have moved your topic to the logstash forum to get more specific help on logstash.
---
### Author:  [@wiibaa](https://discuss.elastic.co/u/wiibaa)
#### Post date: [February 16, 2016, 6:43am UTC](https://discuss.elastic.co/t/nested-array-in-json/41694/5 "2016-02-16T06:43:05Z")
To be sure to understand your request correctly
Can you please provide an example of input json containing "nested json" and if possible a description of the expected structure as output
Also what is the level of nesting, it is simply one or could be more ?
---
### Author:  [@logstash\_oz](https://discuss.elastic.co/u/logstash_oz)
#### Post date: [February 17, 2016, 8:32am UTC](https://discuss.elastic.co/t/nested-array-in-json/41694/6 "2016-02-17T08:32:06Z")
Hi,
I am trying the example here
[https://www.elastic.co/guide/en/elasticsearch/reference/current/nested.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/nested.html)
PUT my\_index/my\_type/1
{
"group" : "fans",
"user" : [
{
"first" : "John",
"last" : "Smith"
},
{
"first" : "Alice",
"last" : "White"
}
]
}
Now the fields in Kibana show the field as User
And value as
{"first":"John","last":"Smith"}, {"first":"Alice","last":"White"}
In contrast splunk, when indexing the same data will break it as following fields
user{}.first
Values
Alice
John
user{}.last
Smith
White
So, in splunk I have much wider options to query on individual first names, for example I can search how many Users have First name as Smith. And also it is easy to understand the data if it is broken into individual logical units.
Thanks
---
### Author:  [@logstash\_oz](https://discuss.elastic.co/u/logstash_oz)
#### Post date: [February 20, 2016, 4:14pm UTC](https://discuss.elastic.co/t/nested-array-in-json/41694/7 "2016-02-20T16:14:34Z")
Am I correct in the assumption that below issue is what my problem is?
Kindly advice.
>
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/nested-array-in-json/41694/8 "2017-07-06T05:10:29Z")