# Parse nested json **URL:** \ **Category:** Logstash\ **Created:** [April 2, 2016, 3:59am UTC](https://discuss.elastic.co/t/parse-nested-json/46114 "2016-04-02T03:59:57Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![ajays](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@ajays](https://discuss.elastic.co/u/ajays)\ **Post date:** [April 2, 2016, 3:59am UTC](https://discuss.elastic.co/t/parse-nested-json/46114/1 "2016-04-02T03:59:57Z")
Hello, I have an input line as given below {"dwo":"0","rs":{"$date":"2016-02-11T00:52:50.348Z"},"first":[{"timestamp":"2016-02-11T00:52:51Z","a":"abc","b":"243253456","c":"fdsfg444323fef"},{"timestamp":"2016-02-11T00:52:51Z","a":"xyz","b":"543q653q654","c":"fewdfsdf","d":"Thu Feb 11 2016 11:52:47 GMT 1100 (AUS Eastern Daylight Time)","e":"4235345"}],"bwv":"40","cp\_tz":{"$date":"2016-02-11T11:52:50.000Z"}} I want to parse this line in logstash so that each field should be searchable even the nested one. I used this configuration but it is not parsing nested json. input { stdin {} } filter { json { source =\> message } } output { stdout { codec =\> rubydebug } } I output I am getting is { "message" =\> "{"dwo":"0","rs":{"$date":"2016-02-11T00:52:50.348Z"},"first":[{"timestamp":"2016-02-11T00:52:51Z","a":"abc","b":"243253456","c":"fdsfg444323fef"},{"timestamp":"2016-02-11T00:52:51Z","a":"xyz","b":"543q653q654","c":"fewdfsdf","d":"Thu Feb 11 2016 11:52:47 GMT 1100 (AUS Eastern Daylight Time)","e":"4235345"}],"bwv":"40","cp\_tz":{"$date":"2016-02-11T11:52:50.000Z"}}", "@version" =\> "1", "@timestamp" =\> "2016-04-02T03:53:14.610Z", "host" =\> "localhost", "dwo" =\> "0", "rs" =\> { "$date" =\> "2016-02-11T00:52:50.348Z" }, "first" =\> [ [0] { "timestamp" =\> "2016-02-11T00:52:51Z", "a" =\> "abc", "b" =\> "243253456", "c" =\> "fdsfg444323fef" }, [1] { "timestamp" =\> "2016-02-11T00:52:51Z", "a" =\> "xyz", "b" =\> "543q653q654", "c" =\> "fewdfsdf", "d" =\> "Thu Feb 11 2016 11:52:47 GMT 1100 (AUS Eastern Daylight Time)", "e" =\> "4235345" } ], "bwv" =\> "40", "cp\_tz" =\> { "$date" =\> "2016-02-11T11:52:50.000Z" } } Can somebody help me to fix this issue? Regards Ajays ---
**Author:** ![ajays](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@ajays](https://discuss.elastic.co/u/ajays)\ **Post date:** [April 2, 2016, 4:56am UTC](https://discuss.elastic.co/t/parse-nested-json/46114/2 "2016-04-02T04:56:30Z")
Hello, In the above output I want to replace @timestamp with the $date field inside cp\_tz as well. Regards, Ajays ---
**Author:** ![ajays](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@ajays](https://discuss.elastic.co/u/ajays)\ **Post date:** [April 2, 2016, 1:20pm UTC](https://discuss.elastic.co/t/parse-nested-json/46114/3 "2016-04-02T13:20:14Z")
Can somebody please help on this? Regards, Ajays ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 2, 2016, 2:41pm UTC](https://discuss.elastic.co/t/parse-nested-json/46114/4 "2016-04-02T14:41:01Z")
> Can somebody help me to fix this issue? What issue? The JSON string is parsed into fields just fine. > In the above output I want to replace @timestamp with the $date field inside cp\_tz as well. Use the date filter to parse the `[cp_tz][$date]` field. > Can somebody please help on this? I can't speak for other people, but this kind of impatient reminder only annoys me. ---
**Author:** ![ajays](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@ajays](https://discuss.elastic.co/u/ajays)\ **Post date:** [April 3, 2016, 3:28am UTC](https://discuss.elastic.co/t/parse-nested-json/46114/5 "2016-04-03T03:28:45Z")
@magnusbaeck, If you look at the below image, you will find that the component inside the "first" json is not indexed hence not searchable. That is what my query is. I am not able to parse nested json. Like you suggested date filter for replacing @timestamp, here is my code which is also not working. I am not sure what am I missing date { match =\> ["cp\_tz.$date","ISO8601"] target =\> "@timestamp" } ![](https://us1.discourse-cdn.com/elastic/original/2X/e/e71d3a6734a6b49e3722b0b140d9ae77711ab73a.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 4, 2016, 5:36am UTC](https://discuss.elastic.co/t/parse-nested-json/46114/6 "2016-04-04T05:36:47Z")
> If you look at the below image, you will find that the component inside the "first" json is not indexed hence not searchable. That is what my query is. I am not able to parse nested json. This is probably because `first` contains an array of objects. If you can extract the elements of that array into separate top-level fields you'll be fine. You may need to use a ruby filter for that. > match =\> ["cp\_tz.$date","ISO8601"] You're not using the correct syntax to reference the nested field. I showed you the correct syntax in my previous response. ---
**Author:** ![ajays](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@ajays](https://discuss.elastic.co/u/ajays)\ **Post date:** [April 4, 2016, 12:23pm UTC](https://discuss.elastic.co/t/parse-nested-json/46114/7 "2016-04-04T12:23:14Z")
@magnusbaeck, Can you give one example or reference for using ruby filter. This time I used the syntax that you told me earlier in your earlier response but still it is not working. ---
**Author:** ![ajays](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@ajays](https://discuss.elastic.co/u/ajays)\ **Post date:** [April 4, 2016, 12:25pm UTC](https://discuss.elastic.co/t/parse-nested-json/46114/8 "2016-04-04T12:25:47Z")
@magnusbaeck, I found this earlier post of yours ([Help parsing nested JSON with dynamic top key](https://discuss.elastic.co/t/help-parsing-nested-json-with-dynamic-top-key/41069)) and tried to use this but somehow it is not working. This is the updated configuration input { stdin {} } filter { ruby { code =\> " event.to\_hash.clone.each\_value{|v| if v.is\_a? Hash v.each\_pair{|k,v| print event[k] = v } end } " } } output { stdout { codec =\> rubydebug } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 4, 2016, 5:12pm UTC](https://discuss.elastic.co/t/parse-nested-json/46114/9 "2016-04-04T17:12:48Z")
> This time I used the syntax that you told me earlier in your earlier response but still it is not working. Look in the Logstash log for more information about date parsing problems. Maybe ISO8601 won't work for this particular date format. You might have to craft your own pattern after all. Your ruby filter attempts to do something completely different. This piece of code should be closer to what you want: ```auto event['first'].each_index { |i| event['whatever' + i.to_s] = event['first'][i] } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/parse-nested-json/46114/11 "2017-07-06T04:28:17Z")