# Parsing JSON array inside

**URL:** <https://discuss.elastic.co/t/parsing-json-array-inside/273870>\
**Category:** Logstash\
**Created:** [May 24, 2021, 9:13pm UTC](https://discuss.elastic.co/t/parsing-json-array-inside/273870 "2021-05-24T21:13:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mirko.spezie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mirko.spezie/32/83705_2.png) [@mirko.spezie](https://discuss.elastic.co/u/mirko.spezie)\
**Post date:** [May 24, 2021, 9:13pm UTC](https://discuss.elastic.co/t/parsing-json-array-inside/273870/1 "2021-05-24T21:13:55Z")

</div>

Hi,  
I've got a json with an array inside. Based on another [thread](https://discuss.elastic.co/t/parsing-json-object-array/190954) I've tried something with ruby to change the key names but it doesn't work.

```auto
  "messages": [
    {
      "message": "XSS Attack Detected via libinjection",
      "details": {
        "data": "Matched Data: XSS data found within ARGS_NAMES: <?xml version",
        "lineNumber": "37",
        "file": "/usr/local/openresty/nginx/conf/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf",
        "reference": "v257,13t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls",
        "tags": [
          "application-multi",
          "OWASP_AppSensor/IE1",
          "CAPEC-242"
        ],
        "ruleId": "941100",
        "ver": "OWASP_CRS/3.2.0",
        "severity": "2",
        "rev": "",
        "match": "detected XSS using libinjection.",
        "accuracy": "0",
        "maturity": "0"
      }
    },
    {
      "message": "Inbound Anomaly Score Exceeded (Total Score: 5)",
      "details": {
        "data": "",
        "lineNumber": "80",
        "file": "/usr/local/openresty/nginx/conf/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf",
        "tags": [
          "application-multi",
          "attack-generic"
        ],
        "reference": "",
        "ruleId": "949110",
        "ver": "OWASP_CRS/3.2.0",
        "severity": "2",
        "rev": "",
        "match": "Matched \"Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' )",
        "accuracy": "0",
        "maturity": "0"
      }
    }
  ],
  "user_agent": {
    "original": "MauiBot (crawler.feedback+wc@gmail.com)",
    "os_name": "Other",
    "device": "Spider",
    "os": "Other",
    "build": "",
    "name": "MauiBot"
  },
  "destination": {
    "ip": "127.0.0.1",
    "port": 80
  }

```

I'd like to differentiate [messages][message] so I've used this code but it doesn't work:

```auto
filter {
  if ([messages][message][0]) {
    ruby {
      code => '
        c = event.get("messages")
        if c
        c.each_index { |x|
          event.set("message-#{x}", c[x]["message"])
        }
        end
      '
    }
    mutate {
      add_field => {
        "modsec_message" => "%{[messages][message][0]}"
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 24, 2021, 10:44pm UTC](https://discuss.elastic.co/t/parsing-json-array-inside/273870/2 "2021-05-24T22:44:14Z")

</div>

> [@mirko.spezie](#):
>
> `[messages][message][0]`

Replace both occurrences of this with `[messages][0][message]`

---

<div class="post-metadata">

**Author:** ![mirko.spezie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mirko.spezie/32/83705_2.png) [@mirko.spezie](https://discuss.elastic.co/u/mirko.spezie)\
**Post date:** [May 25, 2021, 9:53am UTC](https://discuss.elastic.co/t/parsing-json-array-inside/273870/3 "2021-05-25T09:53:34Z")

</div>

thanks it works!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2021, 9:54am UTC](https://discuss.elastic.co/t/parsing-json-array-inside/273870/4 "2021-06-22T09:54:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.