# Parse/split nested single JSON array in Logstash

**URL:** <https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059>\
**Category:** Logstash\
**Created:** [January 18, 2017, 5:16pm UTC](https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059 "2017-01-18T17:16:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thomas\_Schneider](https://avatars.discourse-cdn.com/v4/letter/t/85f322/32.png) [@Thomas\_Schneider](https://discuss.elastic.co/u/Thomas_Schneider)\
**Post date:** [January 18, 2017, 5:16pm UTC](https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059/1 "2017-01-18T17:16:25Z")

</div>

Hello @all,

i am a completely noob and need help on a JSON-file 🙂

I am looking for a splitting/filter for the following JSON-array.  
We need each value in the array as an single value in elastice.

Can someone help me ?

> {  
> "Mot\_Temp\_Test" : {  
> "INT" : ["0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0"]  
> }  
> }

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 22, 2017, 1:33pm UTC](https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059/2 "2017-01-22T13:33:07Z")

</div>

Single value how? As separate documents? Or as separate fields in the same document? How should those fields be named?

---

<div class="post-metadata">

**Author:** ![Thomas\_Schneider](https://avatars.discourse-cdn.com/v4/letter/t/85f322/32.png) [@Thomas\_Schneider](https://discuss.elastic.co/u/Thomas_Schneider)\
**Post date:** [January 22, 2017, 2:04pm UTC](https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059/3 "2017-01-22T14:04:18Z")

</div>

Hi,

as a separate field int eh same document.  
Name e.g. Mot\_Temp\_Test\_[1-12].

Is this possible?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 22, 2017, 3:29pm UTC](https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059/4 "2017-01-22T15:29:09Z")

</div>

Yes, but I don't think there's a standard filter that can do exactly this. A ruby filter will let you do it though. Something like this might work:

```nohighlight
ruby {
  code => '
    event.get("[Mot_Temp_Test][INT]").each { |i|
      event.set("Mot_Temp_Test_#{i+1}", i.to_i)
    }
  '
}

```

---

<div class="post-metadata">

**Author:** ![Thomas\_Schneider](https://avatars.discourse-cdn.com/v4/letter/t/85f322/32.png) [@Thomas\_Schneider](https://discuss.elastic.co/u/Thomas_Schneider)\
**Post date:** [January 25, 2017, 12:09pm UTC](https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059/5 "2017-01-25T12:09:42Z")

</div>

Thanks a lot 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2017, 12:09pm UTC](https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059/6 "2017-02-22T12:09:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.