# Nested json with multi field parsing through logstash
**URL:** https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549
**Category:** Logstash
**Created:** [October 23, 2023, 8:50am UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549 "2023-10-23T08:50:06Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)
#### Post date: [October 23, 2023, 8:50am UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/1 "2023-10-23T08:50:06Z")
Please help me with below log how do I parse it ?
{"@timestamp":"2023-10-11T07:38:56.607Z","log.level":"error","message":"API REQUEST TIME","ecs":{"version":"1.6.0"},"requestedAPI":["[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/74932839?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/74932839?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1) POTIME=1.677sec","[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546550?mode=large&hostid=374&contenttype=all&perpage=5&pageno=1](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546550?mode=large&hostid=374&contenttype=all&perpage=5&pageno=1) POTIME=1.666sec","[http://miscjcmssolr.indiatimes.com/TOISearchWs/recommendation?wt=json&msid=104228058&hostid=53&fl=title,msid,hostid,contenttypeid,contentsubtypeid,effectivedate,seopath&perpage=3&type=article,video,slideshow](http://miscjcmssolr.indiatimes.com/TOISearchWs/recommendation?wt=json&msid=104228058&hostid=53&fl=title,msid,hostid,contenttypeid,contentsubtypeid,effectivedate,seopath&perpage=3&type=article,video,slideshow) POTIME=1.983sec","[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/3531240?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/3531240?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1) POTIME=2.086sec","[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/2279790?mode=large&hostid=53&contenttype=all&perpage=7&pageno=1](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/2279790?mode=large&hostid=53&contenttype=all&perpage=7&pageno=1) POTIME=2.082sec","[https://cloudservices.indiatimes.com/cms-api/priority/68668311?mode=large&hostid=53&contenttype=all&perpage=2&pageno=1](https://cloudservices.indiatimes.com/cms-api/priority/68668311?mode=large&hostid=53&contenttype=all&perpage=2&pageno=1) POTIME=2.091sec","[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546550?mode=large&hostid=374&contenttype=all&perpage=1&pageno=1](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546550?mode=large&hostid=374&contenttype=all&perpage=1&pageno=1) POTIME=2.059sec","[https://cloudservices.indiatimes.com/cms-analytics/mostread?hostid=53§ions=sports&days=3&perpage=6&mode=medium](https://cloudservices.indiatimes.com/cms-analytics/mostread?hostid=53§ions=sports&days=3&perpage=6&mode=medium) POTIME=2.065sec","[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/58166012?mode=large&hostid=53&contenttype=all&perpage=1&pageno=1](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/58166012?mode=large&hostid=53&contenttype=all&perpage=1&pageno=1) POTIME=2.092sec","[https://cloudservices.indiatimes.com/cms-api/detail/104045553,104226596,104050938?hostid=53](https://cloudservices.indiatimes.com/cms-api/detail/104045553,104226596,104050938?hostid=53) POTIME=0.213sec"],"caller":"res.send:122","sitename":"nbt\_app","zone":"vsp1","env":"production","requrl":"/app/endofarticle.cms?secmsid=2279790&msid=104228058&property=NBT&platform=android&vrsn=4600&islive=yes&adsec=sports"}
---
### Author:  [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)
#### Post date: [October 23, 2023, 8:52am UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/2 "2023-10-23T08:52:21Z")
I want a output like below SS.
This is another case I have a log like this
{"@timestamp":"2023-10-11T07:38:56.607Z","log.level":"error","message":"API REQUEST TIME","ecs":{"version":"1.6.0"},"requestedAPI":["[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/74932839?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/74932839?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1) POTIME=1.677sec","[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546550?mode=large&hostid=374&contenttype=all&perpage=5&pageno=1](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546550?mode=large&hostid=374&contenttype=all&perpage=5&pageno=1) POTIME=1.666sec","[http://miscjcmssolr.indiatimes.com/TOISearchWs/recommendation?wt=json&msid=104228058&hostid=53&fl=title,msid,hostid,contenttypeid,contentsubtypeid,effectivedate,seopath&perpage=3&type=article,video,slideshow](http://miscjcmssolr.indiatimes.com/TOISearchWs/recommendation?wt=json&msid=104228058&hostid=53&fl=title,msid,hostid,contenttypeid,contentsubtypeid,effectivedate,seopath&perpage=3&type=article,video,slideshow) POTIME=1.983sec","[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/3531240?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/3531240?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1) POTIME=2.086sec","[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/2279790?mode=large&hostid=53&contenttype=all&perpage=7&pageno=1](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/2279790?mode=large&hostid=53&contenttype=all&perpage=7&pageno=1) POTIME=2.082sec","[https://cloudservices.indiatimes.com/cms-api/priority/68668311?mode=large&hostid=53&contenttype=all&perpage=2&pageno=1](https://cloudservices.indiatimes.com/cms-api/priority/68668311?mode=large&hostid=53&contenttype=all&perpage=2&pageno=1) POTIME=2.091sec","[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546550?mode=large&hostid=374&contenttype=all&perpage=1&pageno=1](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546550?mode=large&hostid=374&contenttype=all&perpage=1&pageno=1) POTIME=2.059sec","[https://cloudservices.indiatimes.com/cms-analytics/mostread?hostid=53§ions=sports&days=3&perpage=6&mode=medium](https://cloudservices.indiatimes.com/cms-analytics/mostread?hostid=53§ions=sports&days=3&perpage=6&mode=medium) POTIME=2.065sec","[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/58166012?mode=large&hostid=53&contenttype=all&perpage=1&pageno=1](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/58166012?mode=large&hostid=53&contenttype=all&perpage=1&pageno=1) POTIME=2.092sec","[https://cloudservices.indiatimes.com/cms-api/detail/104045553,104226596,104050938?hostid=53](https://cloudservices.indiatimes.com/cms-api/detail/104045553,104226596,104050938?hostid=53) POTIME=0.213sec"],"caller":"res.send:122","sitename":"nbt\_app","zone":"vsp1","env":"production","requrl":"/app/endofarticle.cms?secmsid=2279790&msid=104228058&property=NBT&platform=android&vrsn=4600&islive=yes&adsec=sports"}
and I want the output like this below formatted json:
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 23, 2023, 1:39pm UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/3 "2023-10-23T13:39:29Z")
What have you tried? Not sure what is the issue, this is a json message you need to use the `json` filter to parse it.
---
### Author:  [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)
#### Post date: [October 26, 2023, 5:58am UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/4 "2023-10-26T05:58:33Z")
It's not working, It's not parsing it properly it's throwing \_jsonparsefailure
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 26, 2023, 12:27pm UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/5 "2023-10-26T12:27:08Z")
> [@sudhir\_singh](#):
>
> It's not working, It's not parsing it properly it's throwing \_jsonparsefailure
But what does your configuration looks like? You didn't share anything about the Logstash configuration you are using.
You need to provide some context, what is your input? What is the configuration you are using? Is your json one document per line or it is pretty printed in your input?
Please share your Logstash configuration.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 26, 2023, 12:52pm UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/6 "2023-10-26T12:52:45Z")
I had no issue parsing this json.
```auto
[2023-10-26T09:51:31,704][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=>"main"}
[2023-10-26T09:51:31,756][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
{
"ecs" => {
"version" => "1.6.0"
},
"sitename" => "nbt_app",
"@timestamp" => 2023-10-11T07:38:56.607Z,
"host" => "lab",
"log.level" => "error",
"zone" => "vsp1",
"caller" => "res.send:122",
"requestedAPI" => [
[0] "https://cloudservices.indiatimes.com/cms-api/leafhierarchy/74932839?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1 POTIME=1.677sec",
[1] "https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546550?mode=large&hostid=374&contenttype=all&perpage=5&pageno=1 POTIME=1.666sec",
[2] "http://miscjcmssolr.indiatimes.com/TOISearchWs/recommendation?wt=json&msid=104228058&hostid=53&fl=title,msid,hostid,contenttypeid,contentsubtypeid,effectivedate,seopath&perpage=3&type=article,video,slideshow POTIME=1.983sec",
[3] "https://cloudservices.indiatimes.com/cms-api/leafhierarchy/3531240?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1 POTIME=2.086sec",
[4] "https://cloudservices.indiatimes.com/cms-api/leafhierarchy/2279790?mode=large&hostid=53&contenttype=all&perpage=7&pageno=1 POTIME=2.082sec",
[5] "https://cloudservices.indiatimes.com/cms-api/priority/68668311?mode=large&hostid=53&contenttype=all&perpage=2&pageno=1 POTIME=2.091sec",
[6] "https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546550?mode=large&hostid=374&contenttype=all&perpage=1&pageno=1 POTIME=2.059sec",
[7] "https://cloudservices.indiatimes.com/cms-analytics/mostread?hostid=53§ions=sports&days=3&perpage=6&mode=medium POTIME=2.065sec",
[8] "https://cloudservices.indiatimes.com/cms-api/leafhierarchy/58166012?mode=large&hostid=53&contenttype=all&perpage=1&pageno=1 POTIME=2.092sec",
[9] "https://cloudservices.indiatimes.com/cms-api/detail/104045553,104226596,104050938?hostid=53 POTIME=0.213sec"
],
"requrl" => "/app/endofarticle.cms?secmsid=2279790&msid=104228058&property=NBT&platform=android&vrsn=4600&islive=yes&adsec=sports",
"env" => "production",
"@version" => "1"
}
[2023-10-26T09:51:32,013][INFO][logstash.javapipeline][main] Pipeline terminated {"pipeline.id"=>"main"}
```
---
### Author:  [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)
#### Post date: [October 31, 2023, 10:54am UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/7 "2023-10-31T10:54:50Z")
{"@timestamp":"2023-10-20T10:39:21.825Z","log.level":"error","message":"API REQUEST TIME","ecs.version":"1.6.0","requestedAPI":[{"apiUrl":"[https://cloudservices.indiatimes.com/cms-api/leafhierarchy/58166012?mode=large&hostid=53&contenttype=all&perpage=1&pageno=1","apiUrlPOTIME\_inSEC":0.056},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/75432298?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1","apiUrlPOTIME\_inSEC":0.065},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/88049765?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1","apiUrlPOTIME\_inSEC":0.052},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/priority/68668311?mode=large&hostid=53&contenttype=all&perpage=2&pageno=1","apiUrlPOTIME\_inSEC":0.079},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/33503484?mode=large&hostid=53&contenttype=all&perpage=7&pageno=1","apiUrlPOTIME\_inSEC":0.077},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546524?mode=large&hostid=374&contenttype=all&perpage=1&pageno=1","apiUrlPOTIME\_inSEC":0.081},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546524?mode=large&hostid=374&contenttype=all&perpage=5&pageno=1","apiUrlPOTIME\_inSEC":0.093},{"apiUrl":"https://cloudservices.indiatimes.com/cms-analytics/mostread?hostid=53§ions=metro&days=3&perpage=6&mode=medium","apiUrlPOTIME\_inSEC":0.075},{"apiUrl":"http://miscjcmssolr.indiatimes.com/TOISearchWs/recommendation?wt=json&msid=104581382&hostid=53&fl=title,msid,hostid,contenttypeid,contentsubtypeid,effectivedate,seopath&perpage=3&type=article,video,slideshow","apiUrlPOTIME\_inSEC":0.113},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/detail/104447157,104228861,104531812?hostid=53","apiUrlPOTIME\_inSEC":0.042}],"totalProcesstime\_inSec":0.353,"caller":"res.send:126","sitename":"nbt\_app","zone":"vsp1","env":"production","requrl":"/app/endofarticle.cms?secmsid=33503484&msid=104581382&property=NBT&platform=android&vrsn=4590&islive=yes&adsec=news](https://cloudservices.indiatimes.com/cms-api/leafhierarchy/58166012?mode=large&hostid=53&contenttype=all&perpage=1&pageno=1%22,%22apiUrlPOTIME_inSEC%22:0.056%7D,%7B%22apiUrl%22:%22https://cloudservices.indiatimes.com/cms-api/leafhierarchy/75432298?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1%22,%22apiUrlPOTIME_inSEC%22:0.065%7D,%7B%22apiUrl%22:%22https://cloudservices.indiatimes.com/cms-api/leafhierarchy/88049765?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1%22,%22apiUrlPOTIME_inSEC%22:0.052%7D,%7B%22apiUrl%22:%22https://cloudservices.indiatimes.com/cms-api/priority/68668311?mode=large&hostid=53&contenttype=all&perpage=2&pageno=1%22,%22apiUrlPOTIME_inSEC%22:0.079%7D,%7B%22apiUrl%22:%22https://cloudservices.indiatimes.com/cms-api/leafhierarchy/33503484?mode=large&hostid=53&contenttype=all&perpage=7&pageno=1%22,%22apiUrlPOTIME_inSEC%22:0.077%7D,%7B%22apiUrl%22:%22https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546524?mode=large&hostid=374&contenttype=all&perpage=1&pageno=1%22,%22apiUrlPOTIME_inSEC%22:0.081%7D,%7B%22apiUrl%22:%22https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546524?mode=large&hostid=374&contenttype=all&perpage=5&pageno=1%22,%22apiUrlPOTIME_inSEC%22:0.093%7D,%7B%22apiUrl%22:%22https://cloudservices.indiatimes.com/cms-analytics/mostread?hostid=53§ions=metro&days=3&perpage=6&mode=medium%22,%22apiUrlPOTIME_inSEC%22:0.075%7D,%7B%22apiUrl%22:%22http://miscjcmssolr.indiatimes.com/TOISearchWs/recommendation?wt=json&msid=104581382&hostid=53&fl=title,msid,hostid,contenttypeid,contentsubtypeid,effectivedate,seopath&perpage=3&type=article,video,slideshow%22,%22apiUrlPOTIME_inSEC%22:0.113%7D,%7B%22apiUrl%22:%22https://cloudservices.indiatimes.com/cms-api/detail/104447157,104228861,104531812?hostid=53%22,%22apiUrlPOTIME_inSEC%22:0.042%7D%5D,%22totalProcesstime_inSec%22:0.353,%22caller%22:%22res.send:126%22,%22sitename%22:%22nbt_app%22,%22zone%22:%22vsp1%22,%22env%22:%22production%22,%22requrl%22:%22/app/endofarticle.cms?secmsid=33503484&msid=104581382&property=NBT&platform=android&vrsn=4590&islive=yes&adsec=news)"}
That's the problem I have shared two logs format requestedAPI [0] should be a field type "apiURL" and POTIME should be splited and should be a field too. And please share your logstash configuration.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 31, 2023, 12:05pm UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/8 "2023-10-31T12:05:45Z")
> [@sudhir\_singh](#):
>
> That's the problem I have shared two logs format requestedAPI
You didn't, both logs you shared in your previous post have the same format, only this new log is a little different, you also didn't share any error logs, so it is not clear if you are having issues with Logstash or with Elasticsearch.
The following filters will parse all your json messages and split on the field `requestedAPI`.
```auto
filter {
json {
source => "message"
}
split {
field => ["requestedAPI"]
}
if [requestedAPI][apiUrl] {
mutate {
rename => {
"[requestedAPI]" => "[requestedAPIObject]"
}
}
}
}
```
The conditional on the previous filter is required because you have conflicting documents, in some of them you have `requestedAPI` as a _string_ and in others you may have `requestedAPI` as an _object_, this is not allowed, will give you mapping errors while trying to index the data in Elasticsearch and the conflicting documents will be rejected, so you need to rename the field when it is an json object.
Another option is to fix this in the source of your data, but this is out of the scope of the forum.
---
### Author:  [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)
#### Post date: [November 1, 2023, 11:06am UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/9 "2023-11-01T11:06:57Z")
I'm still getting this error
I used your configuration which is below:
---
### Author:  [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)
#### Post date: [November 1, 2023, 11:10am UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/10 "2023-11-01T11:10:03Z")
My json logs are below:
```auto
{"@timestamp":"2023-11-01T11:07:52.977Z","log.level":"error","message":"API REQUEST TIME","ecs.version":"1.6.0","apiUrl0":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/74932792?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1","apiUrlPOTIME_inSEC0":0.071,"apiUrl1":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/64985397?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1","apiUrlPOTIME_inSEC1":0.065,"apiUrl2":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/58166012?mode=large&hostid=53&contenttype=all&perpage=1&pageno=1","apiUrlPOTIME_inSEC2":0.078,"apiUrl3":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546453?mode=large&hostid=374&contenttype=all&perpage=5&pageno=1","apiUrlPOTIME_inSEC3":0.071,"apiUrl4":"https://cloudservices.indiatimes.com/cms-api/priority/68668311?mode=large&hostid=53&contenttype=all&perpage=2&pageno=1","apiUrlPOTIME_inSEC4":0.066,"apiUrl5":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546453?mode=large&hostid=374&contenttype=all&perpage=1&pageno=1","apiUrlPOTIME_inSEC5":0.063,"apiUrl6":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/64679468?mode=large&hostid=53&contenttype=all&perpage=7&pageno=1","apiUrlPOTIME_inSEC6":0.064,"apiUrl7":"https://cloudservices.indiatimes.com/cms-analytics/mostread?hostid=53§ions=travel&days=3&perpage=6&mode=medium","apiUrlPOTIME_inSEC7":0.063,"apiUrl8":"http://miscjcmssolr.indiatimes.com/TOISearchWs/recommendation?wt=json&msid=104881244&hostid=53&fl=title,msid,hostid,contenttypeid,contentsubtypeid,effectivedate,seopath&perpage=3&type=article,video,slideshow","apiUrlPOTIME_inSEC8":0.26,"apiUrl9":"https://cloudservices.indiatimes.com/cms-api/detail/104571048,104855783,104721160?hostid=53","apiUrlPOTIME_inSEC9":0.032,"totalProcesstime_inSec":0.554,"caller":"res.send:126","sitename":"nbt_app","zone":"vsp1","env":"production","requrl":"/app/endofarticle.cms?secmsid=64679468&msid=104881244&property=NBT&platform=ios&vrsn=6220&islive=yes&adsec=lifestyle"}
{"@timestamp":"2023-11-01T11:07:53.041Z","log.level":"error","message":"Logged in redis file","ecs.version":"1.6.0","tempRequestURI":"/app/endofarticle.cms?secmsid=64679468&msid=104881244&property=NBT&platform=ios&vrsn=6220&islive=yes&adsec=lifestyle POTIME=0.618sec","caller":"res.send:154","sitename":"nbt_app","zone":"vsp1","env":"production","requrl":"/app/endofarticle.cms?secmsid=64679468&msid=104881244&property=NBT&platform=ios&vrsn=6220&islive=yes&adsec=lifestyle"}
{"@timestamp":"2023-11-01T11:07:53.077Z","log.level":"error","message":"API REQUEST TIME","ecs.version":"1.6.0","apiUrl0":"https://cloudservices.indiatimes.com/cms-api/specialsectionhierarchy/69826737?&hostid=53&perpage=30","apiUrlPOTIME_inSEC0":0.016,"apiUrl1":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/69826737?mode=large&hostid=53&contenttype=all&perpage=20&pageno=1","apiUrlPOTIME_inSEC1":0.014,"totalProcesstime_inSec":0.034,"caller":"res.send:126","sitename":"nbt_app","zone":"vsp1","env":"production","requrl":"/app/api_articlelist?msid=69826737&adsec=entertainment&vrsn=4600&platform=android"}
{"@timestamp":"2023-11-01T11:07:53.078Z","log.level":"error","message":"API REQUEST TIME","ecs.version":"1.6.0","apiUrl0":"https://cloudservices.indiatimes.com/cms-api/specialsectionhierarchy/69826737?&hostid=53&perpage=30","apiUrlPOTIME_inSEC0":0.016,"apiUrl1":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/69826737?mode=large&hostid=53&contenttype=all&perpage=20&pageno=1","apiUrlPOTIME_inSEC1":0.014,"totalProcesstime_inSec":0.035,"caller":"res.send:126","sitename":"nbt_app","zone":"vsp1","env":"production","requrl":"/app/api_articlelist?msid=69826737&adsec=entertainment&vrsn=4600&platform=android"}
{"@timestamp":"2023-11-01T11:07:53.245Z","log.level":"error","message":"Got data from redis","ecs.version":"1.6.0","tempRequestURI":"/app/endofarticle.cms?secmsid=33503484&msid=104888115&property=NBT&platform=android&vrsn=4590&islive=yes&adsec=news POTIME=0.003sec","caller":"Command.callback:88","sitename":"nbt_app","zone":"vsp1","env":"production","requrl":"/app/endofarticle.cms?secmsid=33503484&msid=104888115&property=NBT&platform=android&vrsn=4590&islive=yes&adsec=news"}
{"@timestamp":"2023-10-20T10:39:21.825Z","log.level":"error","message":"API REQUEST TIME","ecs.version":"1.6.0","requestedAPI":[{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/58166012?mode=large&hostid=53&contenttype=all&perpage=1&pageno=1","apiUrlPOTIME_inSEC":0.056},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/75432298?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1","apiUrlPOTIME_inSEC":0.065},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/88049765?mode=large&hostid=53&contenttype=all&perpage=5&pageno=1","apiUrlPOTIME_inSEC":0.052},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/priority/68668311?mode=large&hostid=53&contenttype=all&perpage=2&pageno=1","apiUrlPOTIME_inSEC":0.079},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/33503484?mode=large&hostid=53&contenttype=all&perpage=7&pageno=1","apiUrlPOTIME_inSEC":0.077},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546524?mode=large&hostid=374&contenttype=all&perpage=1&pageno=1","apiUrlPOTIME_inSEC":0.081},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/leafhierarchy/96546524?mode=large&hostid=374&contenttype=all&perpage=5&pageno=1","apiUrlPOTIME_inSEC":0.093},{"apiUrl":"https://cloudservices.indiatimes.com/cms-analytics/mostread?hostid=53§ions=metro&days=3&perpage=6&mode=medium","apiUrlPOTIME_inSEC":0.075},{"apiUrl":"http://miscjcmssolr.indiatimes.com/TOISearchWs/recommendation?wt=json&msid=104581382&hostid=53&fl=title,msid,hostid,contenttypeid,contentsubtypeid,effectivedate,seopath&perpage=3&type=article,video,slideshow","apiUrlPOTIME_inSEC":0.113},{"apiUrl":"https://cloudservices.indiatimes.com/cms-api/detail/104447157,104228861,104531812?hostid=53","apiUrlPOTIME_inSEC":0.042}],"totalProcesstime_inSec":0.353,"caller":"res.send:126","sitename":"nbt_app","zone":"vsp1","env":"production","requrl":"/app/endofarticle.cms?secmsid=33503484&msid=104581382&property=NBT&platform=android&vrsn=4590&islive=yes&adsec=news"}
```
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 1, 2023, 12:21pm UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/11 "2023-11-01T12:21:19Z")
This is expected since the messages are different, if you are parsing different messages formats you need to have conditionals.
Check the warning, the message is clear, it says that the `requestedAPI` field is of the type _NilClass_, which means that the field does not exist in your document.
If you have a split filter on a field and this field does not exist in your document, you will get this error, this is unrelated and have no impact on the documents that have the field.
You can ignore this warning, if you want to avoid it you can put the `split` plugin inside a conditional.
```auto
if [requestedAPI] {
split {
field => ["requestedAPI"]
}
}
```
---
### Author:  [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)
#### Post date: [November 5, 2023, 8:58pm UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/12 "2023-11-05T20:58:04Z")
Thank You so much @leandrojmp for the help.
---
### Author:  [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)
#### Post date: [November 5, 2023, 8:59pm UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/13 "2023-11-05T20:59:34Z")
@leandrojmp Can you please help me with below error. I'm facing while intallling fleet and the agent.
```auto
Error: fail to enroll: fail to execute request to fleet-server: x509: certificate signed by unknown authority
```
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 5, 2023, 9:40pm UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/14 "2023-11-05T21:40:55Z")
> [@sudhir\_singh](#):
>
> Can you please help me with below error. I'm facing while intallling fleet and the agent.
I suggest that you open a different topic as this is unrelated to your original question.
Also, check this [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-troubleshooting.html#agent-enrollment-certs).
---
### Author:  [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)
#### Post date: [November 6, 2023, 4:45am UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/15 "2023-11-06T04:45:01Z")
I understand I've already opened the topic for that check the below url:
> [@Fleet-server installation error](https://discuss.elastic.co/t/fleet-server-installation-error/346179):
>
> Hi I'm trying to run fleet I tried with self generated fleet-server certificate and with basic one without generating certificate but ended up having an error.
---
### Author:  [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)
#### Post date: [November 10, 2023, 1:31pm UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/16 "2023-11-10T13:31:21Z")
@leandrojmp can please help with this [Not able to parse completely with grok - #2 by sudhir\_singh](https://discuss.elastic.co/t/not-able-to-parse-completely-with-grok/346870/2)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 8, 2023, 1:31pm UTC](https://discuss.elastic.co/t/nested-json-with-multi-field-parsing-through-logstash/345549/17 "2023-12-08T13:31:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.