# Parsing filter for nested json
**URL:** https://discuss.elastic.co/t/parsing-filter-for-nested-json/239180
**Category:** Logstash
**Created:** [June 29, 2020, 7:37pm UTC](https://discuss.elastic.co/t/parsing-filter-for-nested-json/239180 "2020-06-29T19:37:23Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@korrmal](https://discuss.elastic.co/u/korrmal)
#### Post date: [June 29, 2020, 7:37pm UTC](https://discuss.elastic.co/t/parsing-filter-for-nested-json/239180/1 "2020-06-29T19:37:23Z")
Hi. I have input string
` {'message': 'send data to', 'payload': {'params': {'cardNo': '77'}}, 'remote-url': 'https://api.com/status', 'cookie': {}, 'headers': {'User-Agent': 'req', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive', 'Authorization': 'b *********'', 'Content-Type': 'application/json'}, 'method': 'GET'}\n`
I use this filter in logstash
```auto
filter {
if "testjson" in [tags] {
grok {
match => { "message" => ["%{TIMESTAMP_ISO8601:timestamp} - %{WORD:logger} - %{LOGLEVEL:loglevel} - %{NUMBER:user_id} - %{IPORHOST:request_ip} - %{URI:request_uri} - %{UUID:requies_id} - %{GREEDYDATA:body}"] }
remove_field => "message"
}
mutate {
gsub => ["body", '"',"'"]
}
kv {
source => "body"
# remove_field => ["body"]
target => "testjson"
field_split => ", "
value_split => ":"
trim_key => " "
trim_value => " "
}
json {
source => "testjson"
}
}
```
And have this result
```auto
"testjson": {
"'Authorization'": "'b *********''",
"'Content-Type'": "'application/json'}",
"'method'": "'GET'}\\n",
"{'message'": "send data to",
"'cookie'": "{}",
"'remote-url'": "https://api.com/status",
"'headers'": "{'User-Agent':",
"'Connection'": "keep-alive",
"'Accept'": "*/*",
"{'cardNo'": "'77'}}",
"'Accept-Encoding'": "gzip, deflate",
"'payload'": "{'params':"
},
```
How I can fixed filter for fields like this "{'message'" and "'headers'": "{'User-Agent':"
and parse 'payload': {'params': {'cardNo': '77'}} whitout errors
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 29, 2020, 8:26pm UTC](https://discuss.elastic.co/t/parsing-filter-for-nested-json/239180/2 "2020-06-29T20:26:52Z")
If that really is your input message then get rid of the grok and kv and just use a json filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 27, 2020, 8:26pm UTC](https://discuss.elastic.co/t/parsing-filter-for-nested-json/239180/3 "2020-07-27T20:26:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.