# Nested json using logstash mutate filter

**URL:** https://discuss.elastic.co/t/nested-json-using-logstash-mutate-filter/196551
**Category:** Logstash
**Created:** [August 23, 2019, 3:02pm UTC](https://discuss.elastic.co/t/nested-json-using-logstash-mutate-filter/196551 "2019-08-23T15:02:53Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![chimbu3306](https://avatars.discourse-cdn.com/v4/letter/c/c67d28/32.png) [@chimbu3306](https://discuss.elastic.co/u/chimbu3306)
#### Post date: [August 23, 2019, 3:02pm UTC](https://discuss.elastic.co/t/nested-json-using-logstash-mutate-filter/196551/1 "2019-08-23T15:02:53Z")

</div>

I have the below json where i am trying to create a new json field using the mutate filter but i am not getting the expected results. below is my json and the filter i used

**Actual Json:**

```
{
"@timestamp": "2019-08-23T14:52:17.830Z",
"type": "gateway",
"@version": "1",
"message": " Endpoint response headers: {content-type=application/json;charset=UTF-8, date=Fri, 23 Aug 2019 14:52:17 GMT, x-envoy-upstream-service-time=3, server=envoy, transfer-encoding=chunked}"
}

```

**Expected logstash output:**

```
{
"@timestamp": "2019-08-23T14:52:17.830Z",
"type": "gateway",
"@version": "1",
"payload":{
	"message": " Endpoint response headers: {content-type=application/json;charset=UTF-8, date=Fri, 23 Aug 2019 14:52:17 GMT, x-envoy-upstream-service-time=3, server=envoy, transfer-encoding=chunked}"
    }
}

```

Filter i tried:

```
filter {
    mutate {
    add_field => { "[payload][message]" => "%{message}" }
    }
}
}

```

The below one works fine but not giving the expected output

```
filter {
mutate {
    add_field => { "[payload]" => "%{message}" }
    }
}
}
```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 23, 2019, 3:26pm UTC](https://discuss.elastic.co/t/nested-json-using-logstash-mutate-filter/196551/2 "2019-08-23T15:26:39Z")

</div>

> [@chimbu3306](#):
>
> filter { mutate { add\_field =\> { "[payload][message]" =\> "%{message}" } } }

This works for me.

```
"@timestamp" => 2019-08-23T14:52:17.830Z,
      "type" => "gateway",
   "payload" => {
    "message" => " Endpoint response headers: {content-type=application/json;charset=UTF-8, date=Fri, 23 Aug 2019 14:52:17 GMT, x-envoy-upstream-service-time=3, server=envoy, transfer-encoding=chunked}"
}

```

Note that @timestamp is a LogStash::Timestamp, not a string.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 20, 2019, 3:26pm UTC](https://discuss.elastic.co/t/nested-json-using-logstash-mutate-filter/196551/3 "2019-09-20T15:26:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.