# Nested JSON for hostname with packetbeat & logstash

**URL:** <https://discuss.elastic.co/t/nested-json-for-hostname-with-packetbeat-logstash/66761>\
**Category:** Logstash\
**Created:** [November 21, 2016, 5:38pm UTC](https://discuss.elastic.co/t/nested-json-for-hostname-with-packetbeat-logstash/66761 "2016-11-21T17:38:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tetsuto](https://avatars.discourse-cdn.com/v4/letter/t/5f9b8f/32.png) [@tetsuto](https://discuss.elastic.co/u/tetsuto)\
**Post date:** [November 21, 2016, 5:38pm UTC](https://discuss.elastic.co/t/nested-json-for-hostname-with-packetbeat-logstash/66761/1 "2016-11-21T17:38:43Z")

</div>

I've been trying for quite some time to get this to work with no luck - I'm using the Packetbeat plugin to record http data (and headers).

At present it's getting them currently - however the host is nested within the JSON. I'm trying to pull out the hostname from http.request.headers using the following filter.

> filter {  
> if [type] == "http" {  
> mutate {  
> add\_field =\> { "hostname" =\> "%{[http][request][headers][host]}" }  
> }  
> }  
> }

I'm trying to get the information from

```
"http": {
  "request": {
    "headers": {
      "content-length": 0,
      "host": "www.google.com",
      "connection": "Keep-Alive",
      "accept-encoding": "identity",
      "user-agent": "Wget/1.17.1 (linux-gnu)",
      "accept": "*/*"
    },

```

How would i go about filtering this? Currently seemed to have tried every combination i can find

I'm getting the error below - I'm wondering if it's not working as the field it's trying to split isn't being split by Packetbeat correctly?

> [2016-11-21T17:37:09,607][WARN][logstash.outputs.elasticsearch] Failed action. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"packetbeat-2016.11.21", :\_type=\>"http", :\_routing=\>nil}, 2016-11-21T17:37:08.115Z ip-10-0-193-193 %{message}], :response=\>{"index"=\>{"\_index"=\>"packetbeat-2016.11.21", "\_type"=\>"http", "\_id"=\>"AViH9oPTs5hNkRVWqo3X", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"object mapping for [hostname] tried to parse field [hostname] as object, but found a concrete value"}}}}

Full JSON below in case that helps

> {  
> "\_index": "packetbeat-2016.11.21",  
> "\_type": "http",  
> "\_id": "AViH0R2Is5hNkRVWqnMP",  
> "\_score": null,  
> "_source": {  
> "server": "",  
> "proc": "",  
> "method": "GET",  
> "bytes\_in": 141,  
> "query": "GET /",  
> "ip": "XXX",  
> "type": "http",  
> "client\_proc": "",  
> "tags": [  
> "beats\_input\_raw\_event"  
> ],  
> "path": "/",  
> "client\_port": 58206,  
> "client\_server": "",  
> "@timestamp": "2016-11-21T16:56:17.116Z",  
> "bytes\_out": 10927,  
> "port": 80,  
> "beat": {  
> "hostname": "ip-10-0-193-193",  
> "name": "xxx",  
> "version": "5.0.1"  
> },  
> "@version": "1",  
> "host": "ip-10-0-193-193",  
> "http": {  
> "request": {  
> "headers": {  
> "content-length": 0,  
> "host": "[www.google.com](http://www.google.com)",  
> "connection": "Keep-Alive",  
> "accept-encoding": "identity",  
> "user-agent": "Wget/1.17.1 (linux-gnu)",  
> "accept": "/"  
> },  
> "params": ""  
> },  
> "response": {  
> "headers": {  
> "date": "Mon, 21 Nov 2016 16:56:17 GMT",  
> "content-length": 10261,  
> "server": "gws",  
> "expires": "-1",  
> "transfer-encoding": "chunked",  
> "vary": "Accept-Encoding",  
> "x-frame-options": "SAMEORIGIN",  
> "p3p": "CP="This is not a P3P policy! See [P3P and Google's cookies - Google Account Help](https://www.google.com/support/accounts/answer/151657?hl=en) for more info."",  
> "set-cookie": "NID=91=GjjAcot9wLIWyrPiLTSGi8GSQYX1XOiAlwBpge-0VpmJDJFB-lk5HpjhacImtvCSS89SlTJyAk-nCmoioCaRLOg6it6eXiuKYcsj5CVeMQ895XAlzz_-QjPrN9ZhaVXjgoDHMoMy1c1gamk; expires=Tue, 23-May-2017 16:56:17 GMT; path=/; [domain=.google.com](http://domain=.google.com); HttpOnly",  
> "x-xss-protection": "1; mode=block",  
> "content-type": "text/html; charset=ISO-8859-1",  
> "cache-control": "private, max-age=0",  
> "accept-ranges": "none"  
> },  
> "code": 200,  
> "phrase": "OK"  
> }  
> },  
> "responsetime": 38,  
> "client\_ip": "10.0.193.193",  
> "status": "OK",  
> "direction": "out"  
> },  
> "fields": {  
> "@timestamp": [  
> 1479747377116  
> ]  
> },  
> "highlight": {  
> "type": [  
> "@kibana-highlighted-field@http@/kibana-highlighted-field@"  
> ]  
> },  
> "sort": [  
> 1479747377116  
> ]  
> }

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 27, 2016, 8:15pm UTC](https://discuss.elastic.co/t/nested-json-for-hostname-with-packetbeat-logstash/66761/2 "2016-11-27T20:15:03Z")

</div>

For whatever reason your `hostname` field is mapped as an object, but as your event example shows the actual value you're trying to index is a string. Either make `hostname` and object or reindex your existing data so that `hostname` is mapped as a string.

---

<div class="post-metadata">

**Author:** ![tetsuto](https://avatars.discourse-cdn.com/v4/letter/t/5f9b8f/32.png) [@tetsuto](https://discuss.elastic.co/u/tetsuto)\
**Post date:** [November 27, 2016, 8:45pm UTC](https://discuss.elastic.co/t/nested-json-for-hostname-with-packetbeat-logstash/66761/3 "2016-11-27T20:45:53Z")

</div>

perfect - thanks very much

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 25, 2016, 8:46pm UTC](https://discuss.elastic.co/t/nested-json-for-hostname-with-packetbeat-logstash/66761/4 "2016-12-25T20:46:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.