# Parse any field that has a specific name

**URL:** <https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664>\
**Category:** Logstash\
**Created:** [August 9, 2019, 6:20pm UTC](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664 "2019-08-09T18:20:06Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![baselai](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@baselai](https://discuss.elastic.co/u/baselai)\
**Post date:** [August 9, 2019, 6:20pm UTC](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664/1 "2019-08-09T18:20:06Z")

</div>

Is it possible to parse any field in Json, under any root, that has a unix time format?  
I might have in my json file this field  
`"timestamp": 1554940800000`  
it might be at any root in the json, with this naming convention of the filed might contain **timestamp** as name value

right now I'm parsing it using a hardcoded path because I know where that field is in the json, but I need to generalize it, also process all fields if there is more that one.

```
filter {
  date {
        match => ["[body][resource][value][timestamp]", "UNIX_MS" ]
        target => "[body][resource][value][timestamp]"
  }
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 9, 2019, 6:30pm UTC](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664/2 "2019-08-09T18:30:24Z")

</div>

Do you want the timestamp field overwritten with the parsed date?

---

<div class="post-metadata">

**Author:** ![baselai](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@baselai](https://discuss.elastic.co/u/baselai)\
**Post date:** [August 9, 2019, 6:32pm UTC](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664/3 "2019-08-09T18:32:38Z")

</div>

@Badger Yes, as you can see that I'm parsing that specific field using **match** and **target** , but it might be at any root/level and the json might have more than one field with that unix value to be parsed. If there is more than one field they'll all contain the value **timestamp** in their name at somehow.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 9, 2019, 6:52pm UTC](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664/4 "2019-08-09T18:52:41Z")

</div>

Will you be flattening the JSON with the script I posted yesterday? That greatly simplifies things.

---

<div class="post-metadata">

**Author:** ![baselai](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@baselai](https://discuss.elastic.co/u/baselai)\
**Post date:** [August 9, 2019, 6:54pm UTC](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664/5 "2019-08-09T18:54:58Z")

</div>

@Badger yes exactly, I'll be flattening the json using the ruby script you posted.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 9, 2019, 6:58pm UTC](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664/6 "2019-08-09T18:58:53Z")

</div>

Then you can use

```
    ruby {
        code => '
            event.to_hash.each { |k, v|
                if k =~ /(^|\.)timestamp$/ and v.to_s.to_i == v
                    event.set(k, LogStash::Timestamp.new(Time.at(v/1000)))
                end
            }
        '
    }

```

which will produce

```
      "body.input.value.timestamp" => 2019-04-11T00:00:00.000Z,
```

---

<div class="post-metadata">

**Author:** ![baselai](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@baselai](https://discuss.elastic.co/u/baselai)\
**Post date:** [August 9, 2019, 7:13pm UTC](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664/7 "2019-08-09T19:13:16Z")

</div>

@Badger it didn't work when there is two fields timestamp1 and timestamp2, the ruby code can't detect the field if there is characters after the timestamp value and also when the fields names are 1timestamp 2timestamp

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 9, 2019, 7:55pm UTC](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664/8 "2019-08-09T19:55:06Z")

</div>

You could change the regexp that is matching the field name. What do you mean by 'characters after the timestamp value'?

---

<div class="post-metadata">

**Author:** ![baselai](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@baselai](https://discuss.elastic.co/u/baselai)\
**Post date:** [August 9, 2019, 7:56pm UTC](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664/9 "2019-08-09T19:56:20Z")

</div>

if I have test\_timestamp or 1\_timestamp etc..  
I solved it by adding the .\* anchor:

```
event.to_hash.each { |k, v|
                if k =~ /(^|\.).*timestamp.*$/ and v.to_s.to_i == v
                    event.set(k, LogStash::Timestamp.new(Time.at(v/1000)))
                end
            }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2019, 7:56pm UTC](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664/10 "2019-09-06T19:56:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.