# Nested JSON parsing in dynamic field names

**URL:** <https://discuss.elastic.co/t/nested-json-parsing-in-dynamic-field-names/136211>\
**Category:** Logstash\
**Created:** [June 17, 2018, 2:21pm UTC](https://discuss.elastic.co/t/nested-json-parsing-in-dynamic-field-names/136211 "2018-06-17T14:21:22Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [June 18, 2018, 11:41pm UTC](https://discuss.elastic.co/t/nested-json-parsing-in-dynamic-field-names/136211/2 "2018-06-18T23:41:59Z")

</div>

Do you want to _split_ the event into multiple events, each of which has a `username`, `age`, and `occupation`?

If so, you'll need to do a sequence of things, using the `[@metadata]` namespace (which is not exported from Logstash by default):

- Use the JSON Filter to extract the object from the JSON string into `[@metadata][string-indexed]`
- Convert the string-indexed object into an Array (`[@metadata][items-array]`)
- Split the Event on the resulting array, putting the result at `[@metadata][single-item]`
- Do some cleanup to move the relevant sub-keys up to the top namespace.

```auto
filter {
  json {
    source => "message"
    target => "[@metadata][string-indexed]"
  }
  ruby {
    code => "
      # extract the string-indexed object to a local variable
      string_indexed = event.get('[@metadata][string-indexed]')
      # iterate over the keys in the order of the string-encoded integer index
      items_array = string_indexed.keys.sort_by(&:to_i).map do |key|
        # get the item from the indexed map
        string_indexed[key]
      end
      # set the items array.
      event.set('[@metadata][items-array]', items_array)
    "
  }
  split {
    field => "[@metadata][items-array]"
    target => "[@metadata][single-item]"
  }
  mutate {
    rename => {
      "[@metadata][single-item][username]" => "username"
      "[@metadata][single-item][age]" => "age"
      "[@metadata][single-item][occupation]" => "occupation"
    }
  }
}

```

---

_[View the full topic](https://discuss.elastic.co/t/nested-json-parsing-in-dynamic-field-names/136211)._