# Parse nested JSON using Ruby Filter

**URL:** <https://discuss.elastic.co/t/parse-nested-json-using-ruby-filter/146789>\
**Category:** Logstash\
**Created:** [August 30, 2018, 11:40pm UTC](https://discuss.elastic.co/t/parse-nested-json-using-ruby-filter/146789 "2018-08-30T23:40:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Samvid\_Kulkarni](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Samvid\_Kulkarni](https://discuss.elastic.co/u/Samvid_Kulkarni)\
**Post date:** [August 30, 2018, 11:40pm UTC](https://discuss.elastic.co/t/parse-nested-json-using-ruby-filter/146789/1 "2018-08-30T23:40:32Z")

</div>

I have this json log and i am trying to parse it using ruby filter but i am having hard time as I dont have any knowledge of ruby.

here is my log. Can anyone show me some proper way to parse nested JSON please? Is there some easier way to parse it?

`{"id":"ergegr","category":"Account Provisioning","correlationId":"620eee64-3a07-4e49-9914-2ba00f7e8665","result":"failure","resultReason":"We will attempt to retry an operation that previously failed on Group 'Resident Families_Willow Glen'; Error: This object is to be re-synchronized: . We will retry this operation on the next synchronization attempt.","activityDisplayName":"ergegerg","activityDateTime":"2018-08-18T00:56:23.9827818Z","loggedByService":null,"initiatedBy":{"user":null,"app":{"appId":null,"displayName":"dhyergeger","servicePrincipalId":null,"servicePrincipalName":null}},"targetResources":[{"@odata.type":"#microsoft.graph.targetResourceServicePrincipal","id":"d7994216-7ed7-4212-8d35-866cd1e3bfca","displayName":"ServiceNow","appId":null,"modifiedProperties":[]},{"@odata.type":"#microsoft.graph.targetResourceGroup","id":null,"displayName":"rgerg erger gerherh ","groupType":"unknownFutureValue","modifiedProperties":[]}],"additionalDetails":[{"key":"Details","value":"Error was originally encountered at 2018-07-31 10:59:27Z."},{"key":"ErrorCode","value":"Retry"},{"key":"EventName","value":"EntryEscrowProcess"},{"key":"JoiningProperty","value":"ergerge erger gerg eger"},{"key":"SourceAnchor","value":"a8770470-d502-44cd-b97a-4f3648ee3c86"},{"key":"TargetAnchor","value":""}]}`

I have tried split filter but it is not able to parse the nested arrays quite well.

here is my config file.

```
input {
  stdin{}
}

filter {
  grok {
    match => ["message","(?<json_raw>.*)"]
  }
  ruby { code => '
  i = 0
  sum = 0
  while i < event.get( "targetResources" ).length do
   sum += event.get( "targetResources" + i.to_s )
   i += 1
  end
  event.set( "sum", sum ) 
 '
 }

  }

output {
  stdout{codec => rubydebug}
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2018, 11:40pm UTC](https://discuss.elastic.co/t/parse-nested-json-using-ruby-filter/146789/2 "2018-09-27T23:40:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.