# Parse mixed type of data inside json {\[array\],keys:values}

**URL:** <https://discuss.elastic.co/t/parse-mixed-type-of-data-inside-json-array-keys-values/166590>\
**Category:** Logstash\
**Created:** [January 31, 2019, 3:20pm UTC](https://discuss.elastic.co/t/parse-mixed-type-of-data-inside-json-array-keys-values/166590 "2019-01-31T15:20:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![wonderg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wonderg/32/40428_2.png) [@wonderg](https://discuss.elastic.co/u/wonderg)\
**Post date:** [January 31, 2019, 3:20pm UTC](https://discuss.elastic.co/t/parse-mixed-type-of-data-inside-json-array-keys-values/166590/1 "2019-01-31T15:20:39Z")

</div>

How to parse mixed type of data inside json {[array],keys:values} ?  
{  
"body": {  
"date": "1548930893906",  
"id": "3987741004",  
"origin": "web",  
"parties": [{  
"direction": "in",  
"from": {  
"name": "Name",  
"number": "363289"  
},  
"id": "cs1693819",  
"standAlone": true  
}],  
"serverId": "lab.env",  
"sessionId": "Y3MxNjkzODE5ODM0MDkyNTE5NjFAMTAuMjQuMTQ0Ljk1"  
},  
"event": "Notify",  
"version": "2.3"  
}

split { field =\> "[body][parties]" } - doesn't work because there are keys with values at the end.

[2019-01-31T15:01:34,849][WARN][logstash.filters.split] Only String and Array types are splittable. field: [body][parties] is of type = NilClass

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 31, 2019, 3:41pm UTC](https://discuss.elastic.co/t/parse-mixed-type-of-data-inside-json-array-keys-values/166590/2 "2019-01-31T15:41:41Z")

</div>

Did you use a json filter to put it into another field? If so, include that in the field name.

```
filter {
    json { source => "message" target => "json" }
    split { "field" => "[json][body][parties]" }
}

```

works just fine for me.

---

<div class="post-metadata">

**Author:** ![wonderg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wonderg/32/40428_2.png) [@wonderg](https://discuss.elastic.co/u/wonderg)\
**Post date:** [February 4, 2019, 12:26pm UTC](https://discuss.elastic.co/t/parse-mixed-type-of-data-inside-json-array-keys-values/166590/3 "2019-02-04T12:26:19Z")

</div>

i've realized that not all the incoming messages have parties fields, so warning lines in logs belonged to the messages where split module hadn't found [body][parties].

```
if ("parties" in [body]) {
split { "field" => "[body][parties]" }
}

```

fixed the issue. Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 4, 2019, 12:26pm UTC](https://discuss.elastic.co/t/parse-mixed-type-of-data-inside-json-array-keys-values/166590/4 "2019-03-04T12:26:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.