# Nested array of Json

**URL:** https://discuss.elastic.co/t/nested-array-of-json/123287
**Category:** Logstash
**Created:** [March 9, 2018, 2:44pm UTC](https://discuss.elastic.co/t/nested-array-of-json/123287 "2018-03-09T14:44:29Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![gius78](https://avatars.discourse-cdn.com/v4/letter/g/7ea924/32.png) [@gius78](https://discuss.elastic.co/u/gius78)
#### Post date: [March 9, 2018, 2:44pm UTC](https://discuss.elastic.co/t/nested-array-of-json/123287/1 "2018-03-09T14:44:29Z")

</div>

Hi all,  
sorry if topic has already been discussed, but I could not find a fitting example:

I've a log with the following structure:

`message: {PROF_ID":"P_CUSTOMER","action":"USERROLE","USR_COMP":"0xx","USER_DN":"cn=TEST TEST,ou=externalUsers,o=XXX","USR_EMP_ID":"E00XXX","FILTERS":[{"USR_PROF_FILT_VAL":"IT0XXXXX","FILT_ID":"XXX_CLI_FAT"},{"USR_PROF_FILT_VAL":"0XX","FILT_ID":"XXX_COMPANY"}]}`

I've correctly parsed the first part with a json filter, the problem is the part after the "FILTERS"  
I've used a split filter:

```
split { field => "[MessageJ][FILTERS]"}
}

```

and it creates a couple of events, with the following structure:

```
 MessageJ.FILTERS.FILT_ID => XXX_COMPANY
 MessageJ.FILTERS.USR_PROF_FILT_VAL => 0xx

and:

 MessageJ.FILTERS.FILT_ID => XXX_CLI_FAT
 MessageJ.FILTERS.USR_PROF_FILT_VAL => ITXXXXXX

```

I'd like to obtain something like:

```
MessageJ.FILTERS.XXX_COMPANY => 0xx
MessageJ.FILTERS.XXX_CLI_FAT => ITXXXXXX

```

So only a couple of values, no 2 different events. Also because in that way I lose correlation between data.

is that possible?

thanks a lot

---

<div class="post-metadata">

### Author: ![gius78](https://avatars.discourse-cdn.com/v4/letter/g/7ea924/32.png) [@gius78](https://discuss.elastic.co/u/gius78)
#### Post date: [March 15, 2018, 10:53am UTC](https://discuss.elastic.co/t/nested-array-of-json/123287/2 "2018-03-15T10:53:42Z")

</div>

Any suggestion on how to associate/manipulate elements of the array?

{a=b , c=d} I want to make as a result: b=d

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 12, 2018, 10:53am UTC](https://discuss.elastic.co/t/nested-array-of-json/123287/3 "2018-04-12T10:53:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.