Parsing json array

Elastic Stack Logstash
1

Hi , I have json having same structure as the below . How should I parse it?I tried split filter but its not working .

[
{
"accounting": [
{
"firstName": "a35aa",
"lastName": "Doe",
"age": 23
},
{
"firstName": "a35Mary",
"lastName": "Smith",
"age": 36
}
],
"sales": [
{
"firstName": "a36Sally",
"lastName": "Green",
"age": 27
},
{
"firstName": "a36Jim",
"lastName": "Galley",
"age": 41
}
]
},
{
"accounting": [
{
"firstName": "b36bb",
"lastName": "Doe",
"age": 23
},
{
"firstName": "b36Mary",
"lastName": "Smith",
"age": 36
}
],
"sales": [
{
"firstName": "b36Sally",
"lastName": "Green",
"age": 27
},
{
"firstName": "b36Jim",
"lastName": "Galley",
"age": 41
}
]
}
]

2

Are you able to parse the JSON? What does your filter configuration look like? What results do you want?

4

I wanted to access the inner most fields .

5

Please do not PM people you do not know.

If you configure

    json { source => "message" remove_field => [ "message" ] }
    split { field => "partyacct" }
    split { field => "[partyacct][accounting]" }
    split { field => "[partyacct][sales]" }
    mutate {
        rename => {
            "[partyacct][accounting][firstName]" => "acctppl_firstname"
            "[partyacct][accounting][lastName]" => "acctppl_lastname"
            "[partyacct][accounting][age]" => "acctppl_age"
            "[partyacct][sales][firstName]" => "salesppl_firstname"
            "[partyacct][sales][lastName]" => "salesppl_lastname"
            "[partyacct][sales][age]" => "salesppl_age"
        }
        remove_field => [ "partyacct" ]
    }

then you will get 8 records like

 "acctppl_firstname" => "b36Mary",
  "acctppl_lastname" => "Smith",
      "salesppl_age" => 41,
"salesppl_firstname" => "b36Jim",
       "acctppl_age" => 36,
 "salesppl_lastname" => "Galley"
1 Like
6

Thank You so much for your help and I tried to run the same but I got truncated error like below. Is it possible that my index space is full or any other issue ?

"firstName""[truncated 253 bytes]; line: 1, column: 1])
at [Source: (byte)"[
{

9

This is resolved . Thank you very much.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.