# Parse Json Array to flat object **URL:** \ **Category:** Logstash\ **Created:** [October 19, 2017, 11:06am UTC](https://discuss.elastic.co/t/parse-json-array-to-flat-object/104544 "2017-10-19T11:06:38Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![abudaev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abudaev/32/23184_2.png) [@abudaev](https://discuss.elastic.co/u/abudaev)\ **Post date:** [October 19, 2017, 11:06am UTC](https://discuss.elastic.co/t/parse-json-array-to-flat-object/104544/1 "2017-10-19T11:06:38Z")
Hello. I have a log string like this: > 2017-08-18 14:26:07.757 [pool-18-thread-4] INFO r.s.c.i.s.w.WebSocketServerSessionHandler - SEND [63426612-2bbd-4e34-97c2-6bcc374fd654] OnItemAdded: {"item": {"id": "3ca48ea5-4dd2-47e3-9488-b6f850e5e7eb","type": "Voice","state": "ADDED","customer\_id": "73015"},"properties": [{"name": "PRIMARY\_DNIS","value": "12345"},{"name": "CALL\_ID","value": "3ca48ea5-4dd2-47e3-9488-b6f850e5e7eb"},{"name": "UCID","value": "00001003951503055564"},{"name": "PRIMARY\_ANI","value": "12345"},{"name": "AGENT\_NUMBER","value": "12345"},{"name": "DNIS","value": "12345"},{"name": "AGENT\_LOGIN","value": "12345"},{"name": "CALL\_TYPE","value": "IN"},{"name": "CALLER\_NUMBER","value": "12345"},{"name": "CREATETIME","value": "18.08.2017 14:26:07.610"},{"name": "ANI","value": "12345"},{"name": "EDUID","value": "00001003951503055564"},{"name": "TYPE","value": "VOICE"}],"participants": [{"name": "73015","type": "AGENT","id": "399149939","call\_cause": "CAUSE\_NORMAL","call\_direction": "OUT","state": "INITIATING"},{"name": "73052","type": "AGENT","id": "1175032675","call\_cause": "CAUSE\_NORMAL","call\_direction": "IN","state": "ADDED"}]}, correlation\_id {} I'am use this logstash config for parsing my logs: ``` filter { if [type] =~ "cis" { if [message] =~ "SEND" or [message] =~ "RECEIVED" { grok { match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+\[%{GREEDYDATA:thread}\]\s+%{LOGLEVEL:loglevel}\s+%{GREEDYDATA:log_class}\s+\-\s+((?SEND|REQUEST)?\s+\[(?[0-9A-Fa-f]{8}[-][0-9A-Fa-f]{4}[-][0-9A-Fa-f]{4}[-][0-9A-Fa-f]{4}[-][0-9A-Fa-f]{12})\]\s+(%{DATA:event_type}):\s+(%{GREEDYDATA:json_data})\,\s+correlation_id)?%{GREEDYDATA:text}" } } date { match => ["timestamp","YYYY-MM-dd HH:mm:ss.SSS"] timezone => "Europe/Moscow" } json{ source => "json_data" } if [message] =~ "participants" { split{ field => "[json_data][participants]" terminator => "," target => "participant" remove_field => [json_data] } mutate{ gsub => ["participant", "\]", "" ] gsub => ["participant", "\[", ""] } json{ source => "participant" }; } } else{ drop { } } } } ``` How it work now, but partially. My structrure `{"item": {"id": "3ca48ea5-4dd2-47e3-9488-b6f850e5e7eb","type": "Voice","state": "ADDED","customer_id": "73015"},` parsed as flat ![json 4](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4dee4b68a9c48f76136e8d5ec601c375f3411d09.png) ![json5](https://us1.discourse-cdn.com/elastic/original/3X/b/d/bd97ff4b7207befbb22d4521f66cff152cfb647c.png) and is coorect for me, but this part (array) not transorming: `"participants": [{"name": "73015","type": "AGENT","id": "399149939","call_cause": "CAUSE_NORMAL","call_direction": "OUT","state": "INITIATING"},{"name": "73052","type": "AGENT","id": "1175032675","call_cause": "CAUSE_NORMAL","call_direction": "IN","state": "ADDED"}]` in table view: ![json2](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8cc366efb294ca1bb03829ec0dfd22e3cf2ad87a.png) in json view: ![json3](https://us1.discourse-cdn.com/elastic/original/3X/2/2/22a39dbece10160f0871ab2c864922644efba45d.png) this fields available in list, but they empty: ![json1](https://us1.discourse-cdn.com/elastic/original/3X/8/8/88686b1c1c2ff04c126063f84d823dbce280b01c.png) How i can do it part of my json data (array of participants) to flat objects like item.id ect? How i can change my config? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 19, 2017, 12:57pm UTC](https://discuss.elastic.co/t/parse-json-array-to-flat-object/104544/2 "2017-10-19T12:57:10Z")
Did you notice the \_split\_type\_failure tag? It cannot find [json\_data][participants]. Replace ``` if [message] =~ "participants" { split{ field => "[json_data][participants]" terminator => "," target => "participant" remove_field => [json_data] } mutate{ gsub => ["participant", "\]", "" ] gsub => ["participant", "\[", ""] } json{ source => "participant" } } ``` with ``` if [message] =~ "participants" { split{ field => "[participants]" target => "participant" remove_field => [json_data] } } ``` ---
**Author:** ![abudaev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abudaev/32/23184_2.png) [@abudaev](https://discuss.elastic.co/u/abudaev)\ **Post date:** [October 19, 2017, 4:05pm UTC](https://discuss.elastic.co/t/parse-json-array-to-flat-object/104544/3 "2017-10-19T16:05:54Z")
Great! It's work! But only first element of array move to field ☹ ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 19, 2017, 5:23pm UTC](https://discuss.elastic.co/t/parse-json-array-to-flat-object/104544/4 "2017-10-19T17:23:16Z")
> [@abudaev](#): > > But only first element of array move to field You should get two events. The first will have a participant item that only contains the first entry from the participants array, the second will have a participant item that only contains the second. Everything else will be duplicated in both events. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 16, 2017, 5:23pm UTC](https://discuss.elastic.co/t/parse-json-array-to-flat-object/104544/5 "2017-11-16T17:23:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.