# Parse json message

**URL:** <https://discuss.elastic.co/t/parse-json-message/136549>\
**Category:** Logstash\
**Created:** [June 19, 2018, 6:06pm UTC](https://discuss.elastic.co/t/parse-json-message/136549 "2018-06-19T18:06:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roque\_Moyano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roque_moyano/32/116329_2.png) [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\
**Post date:** [June 19, 2018, 6:06pm UTC](https://discuss.elastic.co/t/parse-json-message/136549/1 "2018-06-19T18:06:39Z")

</div>

Hi , I have a json message log like:

{ 'date': "xx" , 'env': "xx" }

I want to create those fields in elasticsearch just if those fields are present and anything else , my filter is:

```
filter {
json { source =>"message"
   target => "log" }

```

}

output {  
elasticsearch {  
hosts =\> ["x.x.x.x:9200"]  
manage\_template =\> false  
index =\> "docker-%{+YYYY.MM.dd}"  
}  
}

that works but i want to drop the messages that don't satisfy the condition that have only 2 fields in the json log , in this case "date" and "env" , how can I do that?

thanks in advance.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 19, 2018, 6:45pm UTC](https://discuss.elastic.co/t/parse-json-message/136549/2 "2018-06-19T18:45:28Z")

</div>

This will drop the event if it finds a field other than date and env in log.

```
    ruby {
        code => "
            event.get('log').each { |k, v|
                    if k != 'date' and k != 'env'
                        event.cancel()
                    end
            }
        "
    }

```

If I recall correctly the json filter does not like single quotes, so you may need to

```
mutate { gsub => ["message", "'", '"'] }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2018, 6:45pm UTC](https://discuss.elastic.co/t/parse-json-message/136549/3 "2018-07-17T18:45:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.