# Nested json field parsing in filter

**URL:** <https://discuss.elastic.co/t/nested-json-field-parsing-in-filter/85193>\
**Category:** Logstash\
**Created:** [May 10, 2017, 6:28am UTC](https://discuss.elastic.co/t/nested-json-field-parsing-in-filter/85193 "2017-05-10T06:28:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![LmYjQ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lmyjq/32/97480_2.png) [@LmYjQ](https://discuss.elastic.co/u/LmYjQ)\
**Post date:** [May 10, 2017, 6:28am UTC](https://discuss.elastic.co/t/nested-json-field-parsing-in-filter/85193/1 "2017-05-10T06:28:05Z")

</div>

I want to split the following data:

> "ext"=\>{"obj\_ids"=\>[82748684, 83009084, 81688382, 79158756, 80577703, 83010154, 83022121, 83022241, 82890903, 82451572, 83010197, 83010748, 83010992, 83011106, 83012040, 83030525, 83011722, 82692106], "length"=\>20, "start"=\>0}

and my conf is:

> ```
> split {
> field => "ext.obj_ids"
> terminator => ","
> }
> 
> ```

I also added an mapping,

> ```
> "obg_ids": {
> "type": "nested"
> },
> "obj_ids": {
> "type": "long"
> },
> 
> ```

but kibana still can't parse it.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/5/8/5820ea9983a484adab066be4172a1580bcc5644e.png)

and the debug info is:

> WARN logstash.filters.split - Only String and Array types are splittable. field:ext.obj\_ids is of type = NilClass

How can I fix this? Thank you in advance:smile:

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 10, 2017, 6:40am UTC](https://discuss.elastic.co/t/nested-json-field-parsing-in-filter/85193/2 "2017-05-10T06:40:23Z")

</div>

You're using the wrong syntax for nested fields, see [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references).

---

<div class="post-metadata">

**Author:** ![LmYjQ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lmyjq/32/97480_2.png) [@LmYjQ](https://discuss.elastic.co/u/LmYjQ)\
**Post date:** [May 10, 2017, 6:59am UTC](https://discuss.elastic.co/t/nested-json-field-parsing-in-filter/85193/3 "2017-05-10T06:59:38Z")

</div>

Thank you magnus, I changed the conf to  
field =\> "[ext][obj\_ids]"

But another error came out,

> 14:55:00.210 [[main]\>worker13] ERROR logstash.pipeline - Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=\>"undefined method `empty?' for 83058780:Fixnum", "backtrace"=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-split-3.1.1/lib/logstash/filters/split.rb:89:in `filter'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-split-3.1.1/lib/logstash/filters/split.rb:88:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in `multi\_filter'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in `multi\_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter\_delegator.rb:42:in `multi_filter'", "(eval):386:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):383:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):400:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):397:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):157:in `filter\_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:353:in `filter_batch'", "org/jruby/RubyProc.java:281:in `call'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:201:in `each'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:200:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:352:in `filter\_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:340:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:306:in `start\_workers'"]}

my full configuation is

> input {  
> redis {  
> host =\> "localhost"  
> data\_type =\> "list"  
> key =\> "access"  
> type =\> "access"  
> }  
> redis {  
> host =\> "localhost"  
> data\_type =\> "list"  
> key =\> "report\_video"  
> type =\> "report\_video"  
> }  
> }

> filter {  
> mutate {  
> rename =\> { "\_id" =\> "record\_id" }  
> rename =\> { "\_ext" =\> "ext"}  
> }

> ```
> date { match => ["logged_at", "yyyy-MM-dd HH:mm:ss"] }
> 
> ```

> ```
> if [type]=="access" {
> geoip { source => "ip" }
> if [act]=="update" { drop{} }
> 
> ```

> ```
> }
> 
> ```

> ```
> if [type]=="report_video" {
> if [act]=="digest_request" {
> split {
> field => "[ext][obj_ids]"
> terminator => ","
> }
> }
> }
> 
> ```
> 
> }

> output {  
> elasticsearch {  
> hosts =\> "localhost:9200"  
> index =\> "logstash-%{type}-%{+YYYY.MM.dd}"  
> }  
> }

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 10, 2017, 7:30am UTC](https://discuss.elastic.co/t/nested-json-field-parsing-in-filter/85193/4 "2017-05-10T07:30:19Z")

</div>

Known bug:

> <https://github.com/logstash-plugins/logstash-filter-split/issues/13>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2017, 7:36am UTC](https://discuss.elastic.co/t/nested-json-field-parsing-in-filter/85193/5 "2017-06-07T07:36:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.