# Only String and Array types are splittable. field:splitedJson is of type = NilClass **URL:** \ **Category:** Logstash\ **Created:** [July 23, 2019, 2:49am UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-splitedjson-is-of-type-nilclass/191725 "2019-07-23T02:49:22Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\ **Post date:** [July 23, 2019, 2:49am UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-splitedjson-is-of-type-nilclass/191725/1 "2019-07-23T02:49:22Z")
Hello, I have an array of JSON and i can parse them out nicely with logstash. However, i realized that the logs are flooded with > [2019-07-23T10:35:06,859][WARN][logstash.filters.split] Only String and Array types are splittable. field:splitedJson is of type = NilClass I am concern about this and would like to know how can i fix this. my logstash: ``` input { file { path => ["/etc/logstash/conf.d/sysauto/periodic-curl-salt-data/salt-data/Host-LDAP"] start_position => "beginning" type => "json" codec => "json" sincedb_path => "/dev/null" } } filter { json { source => "message" target => "splitedJson" } split { field => "splitedJson" } } output { elasticsearch { hosts => ["http://esnode1:9200", "http://esnode2:9200", "http://esnode3:9200"] index => "sysauto-host-ldap-%{+YYYY.MM.dd}" } } ``` My sample data: > [ > {"DC\_ID":"3","DC\_NAME":"BT","NTP1\_ID":"4","NTP1\_IP":"10.1.4.132","NTP1\_NAME":"CCC-CCORE-DS01-2","NTP1\_STATUS":"active","NTP2\_ID":"8","NTP2\_IP":"10.1.253.254","NTP2\_NAME":"CCC-DSU-DS02-2","NTP2\_STATUS":"active","SUBNET\_ID":"160","SUBNET\_IP":"10.1.101.0","SUBNET\_MASK":"24"} > , > {"DC\_ID":"3","DC\_NAME":"BT","NTP1\_ID":"3","NTP1\_IP":"10.1.4.131","NTP1\_NAME":"CCC-CCORE-DS01-3","NTP1\_STATUS":"active","NTP2\_ID":"5","NTP2\_IP":"10.1.4.140","NTP2\_NAME":"CCC-DSU-DS02-3","NTP2\_STATUS":"active","SUBNET\_ID":"79","SUBNET\_IP":"10.1.2.0","SUBNET\_MASK":"24"} > ] This is the data output: ``` { "NTP1_IP" => "10.1.4.132", "DC_NAME" => "BT", "NTP2_IP" => "10.1.253.254", "NTP1_STATUS" => "active", "host" => "elk-dev-logstash", "NTP1_NAME" => "CCC-CCORE-DS01-2", "NTP1_ID" => "4", "NTP2_STATUS" => "active", "SUBNET_ID" => "160", "NTP2_ID" => "8", "DC_ID" => "3", "@timestamp" => 2019-07-23T03:08:39.667Z, "path" => "/etc/logstash/conf.d/sysauto/periodic-curl-salt-data/salt-data/Host-LDAP", "tags" => [ [0] "_split_type_failure" ], "NTP2_NAME" => CCC-DSU-DS02-2", "type" => "json", "SUBNET_IP" => "10.1.101.0", "SUBNET_MASK" => "24", "@version" => "1" } { "NTP1_IP" => "10.1.4.131", "DC_NAME" => "BT", "NTP2_IP" => "10.1.4.140", "NTP1_STATUS" => "active", "host" => "elk-dev-logstash", "NTP1_NAME" => "CCC-CCORE-DS01-3", "NTP1_ID" => "3", "NTP2_STATUS" => "active", "SUBNET_ID" => "79", "NTP2_ID" => "5", "DC_ID" => "3", "@timestamp" => 2019-07-23T03:08:39.667Z, "path" => "/etc/logstash/conf.d/sysauto/periodic-curl-salt-data/salt-data/Host-LDAP", "tags" => [ [0] "_split_type_failure" ], "NTP2_NAME" => "CCC-DSU-DS02-3", "type" => "json", "SUBNET_IP" => "10.1.2.0", "SUBNET_MASK" => "24", "@version" => "1" } ``` `splitedJson` field does not exist in my data, it is used as a variable. Is it wrong to use it this way? I have tried to `mutate { convert => { "splitedJson" => "string" } }` to convert the data type of `splitedJson` also but i still receive the same warning. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 23, 2019, 1:26pm UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-splitedjson-is-of-type-nilclass/191725/2 "2019-07-23T13:26:43Z")
You are using a json codec on the input, so you have no message field, so the json filter is a no-op, so the splitedJson field never gets created. If the entire array is ingested as a single event then the json codec does the split for you. If you are ingesting the lines one at a time you will get errors for the lines containing the [and the]. But you can fix that with ``` if [message] drop {} ``` That will drop anything that the json codec cannot parse. ---
**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\ **Post date:** [July 24, 2019, 1:53am UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-splitedjson-is-of-type-nilclass/191725/3 "2019-07-24T01:53:09Z")
Your solution works! However, the line you quoted gave me some error. > [@Badger](#): > > if [message] drop {} Writing it this way fixed it 🙂 ``` filter { if [message] { drop { } } } ``` Thank you Badger! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 21, 2019, 1:53am UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-splitedjson-is-of-type-nilclass/191725/4 "2019-08-21T01:53:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.