# Parse single line multi object json with logstash

**URL:** https://discuss.elastic.co/t/parse-single-line-multi-object-json-with-logstash/207608
**Category:** Logstash
**Created:** [November 13, 2019, 1:15am UTC](https://discuss.elastic.co/t/parse-single-line-multi-object-json-with-logstash/207608 "2019-11-13T01:15:10Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![sili.redwork](https://avatars.discourse-cdn.com/v4/letter/s/9e8a1a/32.png) [@sili.redwork](https://discuss.elastic.co/u/sili.redwork)
#### Post date: [November 13, 2019, 6:43pm UTC](https://discuss.elastic.co/t/parse-single-line-multi-object-json-with-logstash/207608/5 "2019-11-13T18:43:07Z")

</div>

Thanks Manud, Still no joy.

**Configuration**

> ```
> input {
> file {
> path => "sample_masked_log"
> codec => "json"
> type => "Log"
> sincedb_path => "/tmp/sincedb"
> start_position => "beginning"
> }
> }
> filter {
> mutate {
> gsub => [ "message", "}{", "}
> {" ]
> }
> split {
> field => "message"
> }
> json {
> source => "message"
> }
> 
> split {
> field => "[logEvents]"
> }
> mutate {
> add_field => {
> "log-event-id" => "%{[logEvents][id]}"
> "log-event-message" => "%{[logEvents][message]}"
> "log-event-time" => "%{[logEvents][timestamp]}"
> }
> remove_field => [
> "[message]",
> "[host]",
> "[path]",
> "[logEvents]",
> "[subscriptionFilters]",
> "[messageType]"
> ]
> }
> }
> output {
> stdout { codec => rubydebug }
> }
> 
> ```

**Content of sample\_masked\_log file**

> {"messageType": "DATA\_MESSAGE","owner": "owner-id","logGroup": "log-group","logStream": "log-stream","subscriptionFilters": ["Destination"],"logEvents": [{"id": "event-id","timestamp": 1573519068908,"message": "{}"},{"id": "event-id","timestamp": 1573519068908,"message": "{}"}]}{"messageType": "DATA\_MESSAGE","owner": "owner-id","logGroup": "log-group","logStream": "log-stream","subscriptionFilters": ["Destination"],"logEvents": [{"id": "event-id","timestamp": 1573518985345,"message": "{}"}]}

**Output**

> {  
> "@timestamp" =\> 2019-11-13T18:34:20.892Z,  
> "logGroup" =\> "log-group",  
> "type" =\> "Log",  
> "log-event-time" =\> "1573519068908",  
> "@version" =\> "1",  
> "tags" =\> [  
> [0] "\_split\_type\_failure"  
> ],  
> "logStream" =\> "log-stream",  
> "log-event-message" =\> "{}",  
> "owner" =\> "owner-id",  
> "log-event-id" =\> "event-id"  
> }  
> {  
> "@timestamp" =\> 2019-11-13T18:34:20.892Z,  
> "logGroup" =\> "log-group",  
> "type" =\> "Log",  
> "log-event-time" =\> "1573519068908",  
> "@version" =\> "1",  
> "tags" =\> [  
> [0] "\_split\_type\_failure"  
> ],  
> "logStream" =\> "log-stream",  
> "log-event-message" =\> "{}",  
> "owner" =\> "owner-id",  
> "log-event-id" =\> "event-id"  
> }

---

_[View the full topic](https://discuss.elastic.co/t/parse-single-line-multi-object-json-with-logstash/207608)._