# New to logstash, Need help to fetch the value from the spcecific column, which is array of strings
**URL:** https://discuss.elastic.co/t/new-to-logstash-need-help-to-fetch-the-value-from-the-spcecific-column-which-is-array-of-strings/125855
**Category:** Logstash
**Created:** [March 28, 2018, 5:40am UTC](https://discuss.elastic.co/t/new-to-logstash-need-help-to-fetch-the-value-from-the-spcecific-column-which-is-array-of-strings/125855 "2018-03-28T05:40:12Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@sridharb](https://discuss.elastic.co/u/sridharb)
#### Post date: [March 28, 2018, 5:40am UTC](https://discuss.elastic.co/t/new-to-logstash-need-help-to-fetch-the-value-from-the-spcecific-column-which-is-array-of-strings/125855/1 "2018-03-28T05:40:12Z")
Need help to display values of specific column column18 as fields, column is array of strings
Below is the column18:
{"accept":["text/html, image/gif, image/jpeg, \*; q=.2, _/_; q=.2"],"host":["[xxx.xx.xxx.com](http://xxx.xx.xxx.com)"],"pragma":["no-cache"],"user-agent":["Java/1.7.0\_67"],"x-forwarded-for":["66.77.88.196"],"x-forwarded-port":["443"],"x-forwarded-proto":["https"]}
My conf file is
filter{
if [type] == "fraccess" {
csv {
columns =\> ["id","timestamp","eventName","transactionId","userId","trackingIds","server.ip","server.port","client.ip","client.port","request.protocol","request.operation","request.detail","component","realm"]
separator =\> ","
}
date {
match =\> ["time", "yyyy-MM-dd HH:mm:ss"]
}
}
```
if [type] == "fraccess" {
mutate {
add_field => { "indexname" => "am13.5" }
}
```
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 28, 2018, 6:19am UTC](https://discuss.elastic.co/t/new-to-logstash-need-help-to-fetch-the-value-from-the-spcecific-column-which-is-array-of-strings/125855/2 "2018-03-28T06:19:24Z")
> {"accept":["text/html, image/gif, image/jpeg, \*; q=.2, /; q=.2"],"host":["[xxx.xx.xxx.com](http://xxx.xx.xxx.com)"],"pragma":["no-cache"],"user-agent":["Java/1.7.0\_67"],"x-forwarded-for":["66.77.88.196"],"x-forwarded-port":["443"],"x-forwarded-proto":["https"]}
This is JSON. Use a json filter to parse it.
---
### Author:  [@sridharb](https://discuss.elastic.co/u/sridharb)
#### Post date: [March 28, 2018, 2:21pm UTC](https://discuss.elastic.co/t/new-to-logstash-need-help-to-fetch-the-value-from-the-spcecific-column-which-is-array-of-strings/125855/3 "2018-03-28T14:21:09Z")
Hi,
Thanks for quick response, column18 which I am referring is after parsing a csv file, so please let me know how to include json parser in the conf file to filter the column18 which is as Json data.
Regards,
Sridhar
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 30, 2018, 7:56pm UTC](https://discuss.elastic.co/t/new-to-logstash-need-help-to-fetch-the-value-from-the-spcecific-column-which-is-array-of-strings/125855/4 "2018-03-30T19:56:39Z")
You already have three filters in your configuration file so it's not clear what part you're finding difficult. Just add a json filter somewhere after the csv filter and make sure to set its `source` option to find to the name of the field containing the JSON data.
---
### Author:  [@sridharb](https://discuss.elastic.co/u/sridharb)
#### Post date: [April 4, 2018, 6:50pm UTC](https://discuss.elastic.co/t/new-to-logstash-need-help-to-fetch-the-value-from-the-spcecific-column-which-is-array-of-strings/125855/5 "2018-04-04T18:50:03Z")
Thanks,
It's working able to parse JSON data.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 2, 2018, 6:50pm UTC](https://discuss.elastic.co/t/new-to-logstash-need-help-to-fetch-the-value-from-the-spcecific-column-which-is-array-of-strings/125855/6 "2018-05-02T18:50:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.