# Parse Json

**URL:** <https://discuss.elastic.co/t/parse-json/357405>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring\
**Created:** [April 15, 2024, 10:11am UTC](https://discuss.elastic.co/t/parse-json/357405 "2024-04-15T10:11:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![AndrewO](https://avatars.discourse-cdn.com/v4/letter/a/f475e1/32.png) [@AndrewO](https://discuss.elastic.co/u/AndrewO)\
**Post date:** [April 15, 2024, 10:11am UTC](https://discuss.elastic.co/t/parse-json/357405/1 "2024-04-15T10:11:48Z")

</div>

Hello  
Help me parse the logs, I'm a beginner, I don't understand how to do it.  
My log:  
`{"bucket":"22-11-2023-test1111111111","time":"2024-04-15T10:01:53.539568Z","time_local":"2024-04-15T10:01:53.539568+0000","remote_addr":"10.1.106.86","object_owner":"<mark>lc</mark>-<mark>ogay_52511</mark>","user":"<mark>lc</mark>-<mark>ogay_52511</mark>","operation":"get_obj","uri":"HEAD /22-11-2023-test1111111111/Linux.txt HTTP/1.1","http_status":"200","error_code":"","bytes_sent":0,"bytes_received":0,"object_size":12771,"total_time":10,"user_agent":"S3 Browser/11.5.7 (https://s3browser.com)","referrer":"","trans_id":"tx000009bb45168c7caae9b-00661cfb11-14c2ce9-second","authentication_type":"Local","access_key_id":"VT534608KBQHA5A595U2P","temp_url":false}`

I want to get the field "method" =\> "HEAD"

My conf (This is one of the options):

```auto
filter
{
    json
    {
        source => "message"
        split => ["message",", "]
        add_field => { "method" => "%{[message][2]}" }
    }
}

```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [April 15, 2024, 3:38pm UTC](https://discuss.elastic.co/t/parse-json/357405/2 "2024-04-15T15:38:28Z")

</div>

```auto
input {
  generator {
       message => '{"bucket":"22-11-2023-test1111111111","time":"2024-04-15T10:01:53.539568Z","time_local":"2024-04-15T10:01:53.539568+0000","remote_addr":"10.1.106.86","object_owner":"<mark>lc</mark>-<mark>ogay_52511</mark>","user":"<mark>lc</mark>-<mark>ogay_52511</mark>","operation":"get_obj","uri":"HEAD /22-11-2023-test1111111111/Linux.txt HTTP/1.1","http_status":"200","error_code":"","bytes_sent":0,"bytes_received":0,"object_size":12771,"total_time":10,"user_agent":"S3 Browser/11.5.7 (https://s3browser.com)","referrer":"","trans_id":"tx000009bb45168c7caae9b-00661cfb11-14c2ce9-second","authentication_type":"Local","access_key_id":"VT534608KBQHA5A595U2P","temp_url":false}'
	   count => 1
  }
}
filter {

  json{ source=>"message"}

  prune { whitelist_names => ["uri"]}

  dissect { mapping => { "uri" => "%{method} %{}" } }
	 
  mutate { remove_field => ["uri"] } 
}
output {
 stdout { codec => rubydebug{} }
}

```

Result:

```auto
{
    "method" => "HEAD"
}

```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [April 15, 2024, 6:46pm UTC](https://discuss.elastic.co/t/parse-json/357405/3 "2024-04-15T18:46:29Z")

</div>

The same result, with "@timestamp" and "@version" which can be removed in the mutate remove\_field list :

```auto
filter {
  grok { match => { "message" => [",\"uri\":\"%{DATA:method} %{DATA}\",\"http_status\":"]} }
	 
  mutate { remove_field => ["event", "host", "message"] } 
}

```

The first version json/prune is better in case you decide to have all fields or change white\_list.  
The grok is simpler in case of you need only one field.

---

<div class="post-metadata">

**Author:** ![AndrewO](https://avatars.discourse-cdn.com/v4/letter/a/f475e1/32.png) [@AndrewO](https://discuss.elastic.co/u/AndrewO)\
**Post date:** [April 16, 2024, 11:34am UTC](https://discuss.elastic.co/t/parse-json/357405/4 "2024-04-16T11:34:37Z")

</div>

Thanks! It's work )))