# Parse nested JSON data into logstash

**URL:** https://discuss.elastic.co/t/parse-nested-json-data-into-logstash/283039
**Category:** Logstash
**Created:** [September 1, 2021, 12:31pm UTC](https://discuss.elastic.co/t/parse-nested-json-data-into-logstash/283039 "2021-09-01T12:31:14Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Magesh\_02](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh_02/32/94023_2.png) [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)
#### Post date: [September 1, 2021, 12:31pm UTC](https://discuss.elastic.co/t/parse-nested-json-data-into-logstash/283039/1 "2021-09-01T12:31:15Z")

</div>

New to ELK stack, trying to import my JSON data into elastic serach, but its fails, since my json input is nested types. I have tried many solution but still i could not able to get.

here is my input

```auto
{
  "Folders": [
    {
      "Name": "Folder1",
      "Total Files": [
        {
          "Added": 44488,
          "Deleted": 4444,
          "Total files by extension": [
            {
              "Name": ".txt,exe",
              "Added": 44488,
              "Deleted": 4444

            },
            {
              "Name": ".doc",
              "Added": 44488,
              "Deleted": 4444
            }
          ]
        }
      ]
    },
    {
      "Name": "Folder2",
      "Total Files": [
        {
          "Added": 44488,
          "Deleted": 4444,

          "Total files by extension": [
            {
              "Name": ".txt,.exe",
              "Added": 44488,
              "Deleted": 4444

            },
            {
              "Name": ".doc",
              "Added": 44488,
              "Deleted": 4444

            }
          ]
        }
      ]
    }
  ]
}

```

Config file

```auto
input { 

 file {
   path => "D:/sample.json"
   start_position => "beginning"
    type => "json"
    codec => "json"
    sincedb_path => "/dev/null"
 }
}

filter {
if [message] drop {}
 
}

output {
   
  stdout {
    codec => rubydebug
  }
 
  # Sending properly parsed log events to elasticsearch
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "results"
  }
}

```

Any help on this?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 1, 2021, 1:58pm UTC](https://discuss.elastic.co/t/parse-nested-json-data-into-logstash/283039/2 "2021-09-01T13:58:47Z")

</div>

See [here](https://discuss.elastic.co/t/parsing-a-raw-json-file-invalid-setting-for-json-filter/280735/4).

---

<div class="post-metadata">

### Author: ![Magesh\_02](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh_02/32/94023_2.png) [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)
#### Post date: [September 2, 2021, 5:53am UTC](https://discuss.elastic.co/t/parse-nested-json-data-into-logstash/283039/3 "2021-09-02T05:53:55Z")

</div>

Hi @Badger

I'm still having the same problem, and both solutions result in a json parsing error. The same applies to flattened json data.

Error:

```auto
[2021-09-02T11:20:28,725][WARN][logstash.filters.json][main][a39479da327a8f2b0a3503f33c5a383682f4ba6777108aceccd46983b1e8556f] Error parsing json {:source=>"message", :raw=>" \"Added\": 44488,\r", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')

```

I even tried the same input given in this post

> [@Unable to parse JSON Array object in Logstash](https://discuss.elastic.co/t/unable-to-parse-json-array-object-in-logstash/89247):
>
> I am trying to parse an example JSON Array into Logstash as follow: { "Records": [ { "eventVersion": "1.03", "userIdentity": { "type": "IAMUser", "principalId": "111122223333", "arn": "arn:aws:iam::111122223333:user/myUserName", "accountId": "111122223333", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "myUserName" }, "eventTime": "2015-08-26T20:46:31Z", "eventSource": "s…

Also pipeline was not started

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 2, 2021, 1:05pm UTC](https://discuss.elastic.co/t/parse-nested-json-data-into-logstash/283039/4 "2021-09-02T13:05:31Z")

</div>

> [@Magesh\_02](#):
>
> `:raw=>" \"Added\": 44488,\r"`

That shows that you are trying to parse a single line of a pretty-printed JSON object. You need to combine the entire object into a single [message] field before trying to parse it. The post I linked to explains how to do that.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 30, 2021, 1:06pm UTC](https://discuss.elastic.co/t/parse-nested-json-data-into-logstash/283039/5 "2021-09-30T13:06:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.