# Not able to extract speciific fields in nested multiline json file

**URL:** https://discuss.elastic.co/t/not-able-to-extract-speciific-fields-in-nested-multiline-json-file/39222
**Category:** Logstash
**Created:** [January 14, 2016, 11:06am UTC](https://discuss.elastic.co/t/not-able-to-extract-speciific-fields-in-nested-multiline-json-file/39222 "2016-01-14T11:06:23Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![sharath3185](https://avatars.discourse-cdn.com/v4/letter/s/2bfe46/32.png) [@sharath3185](https://discuss.elastic.co/u/sharath3185)
#### Post date: [January 14, 2016, 11:06am UTC](https://discuss.elastic.co/t/not-able-to-extract-speciific-fields-in-nested-multiline-json-file/39222/1 "2016-01-14T11:06:23Z")

</div>

Hi,

I have a multiline nested json file in the below format

{  
"info": {  
"name": "name1",  
"ip": "12.12.12.12",  
"jobid": "aaa",  
},  
"ssss": "ssdsdsdsdsdsd",  
"configure": {  
"something": false  
},  
"tests": {  
"tc1": {  
"name": "test1",  
"ip": "12.23.34.45",  
"flags": [  
"xxx",  
"yyy"  
],  
"type": "sys"  
},

```
    "tc2": {
        "flags": [
            "rrr", 
            "ggg"
        ], 
        "ip": "1.2.3.4"
    }
},

```

some more data goes here  
.........  
........  
}

I want to extract [tests][tc1][ip], [tests][tc2][ip]

I did try different filters, but none seems to be working. With the below config, logstash pushes all the stuff in json file to elasticsearch

input  
{  
file  
{

```
    path => "path to json file"
    start_position => "beginning"
    sincedb_path => "/dev/null"
	codec => multiline
    {
        pattern => '^\"tests\":'
        negate => true
        what => previous                
    }
    
}

```

}

filter {

```
mutate{
add_field => ["newfield", "%{[tests][0][tc1]}"]
add_field => ["newfiled2", "%{[tests][0][tc2]}"]

```

}  
}  
output  
{  
stdout { codec =\> rubydebug }  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "test\_index"  
document\_type=\> "Test\_script"

```
    }

```

}

Could you please help me on this ASAP to resolve the issue?  
Thanks in advance

---

<div class="post-metadata">

### Author: ![Architha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/architha/32/92477_2.png) [@Architha](https://discuss.elastic.co/u/Architha)
#### Post date: [February 16, 2016, 7:34am UTC](https://discuss.elastic.co/t/not-able-to-extract-speciific-fields-in-nested-multiline-json-file/39222/2 "2016-02-16T07:34:32Z")

</div>

@sharath3185

Hi, have you solved this issue ? I am facing a similar situation.  
Kindly revert if you have a solution . Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:11am UTC](https://discuss.elastic.co/t/not-able-to-extract-speciific-fields-in-nested-multiline-json-file/39222/3 "2017-07-06T05:11:18Z")

</div>