# Parsing json array

**URL:** <https://discuss.elastic.co/t/parsing-json-array/273218>\
**Category:** Logstash\
**Created:** [May 17, 2021, 8:33pm UTC](https://discuss.elastic.co/t/parsing-json-array/273218 "2021-05-17T20:33:51Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amy007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amy007/32/90893_2.png) [@Amy007](https://discuss.elastic.co/u/Amy007)\
**Post date:** [May 17, 2021, 8:33pm UTC](https://discuss.elastic.co/t/parsing-json-array/273218/1 "2021-05-17T20:33:51Z")

</div>

Hi , I have json having same structure as the below . How should I parse it?I tried split filter but its not working .

[  
{  
"accounting": [  
{  
"firstName": "a35aa",  
"lastName": "Doe",  
"age": 23  
},  
{  
"firstName": "a35Mary",  
"lastName": "Smith",  
"age": 36  
}  
],  
"sales": [  
{  
"firstName": "a36Sally",  
"lastName": "Green",  
"age": 27  
},  
{  
"firstName": "a36Jim",  
"lastName": "Galley",  
"age": 41  
}  
]  
},  
{  
"accounting": [  
{  
"firstName": "b36bb",  
"lastName": "Doe",  
"age": 23  
},  
{  
"firstName": "b36Mary",  
"lastName": "Smith",  
"age": 36  
}  
],  
"sales": [  
{  
"firstName": "b36Sally",  
"lastName": "Green",  
"age": 27  
},  
{  
"firstName": "b36Jim",  
"lastName": "Galley",  
"age": 41  
}  
]  
}  
]

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 17, 2021, 8:41pm UTC](https://discuss.elastic.co/t/parsing-json-array/273218/2 "2021-05-17T20:41:49Z")

</div>

Are you able to parse the JSON? What does your filter configuration look like? What results do you want?

---

<div class="post-metadata">

**Author:** ![Amy007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amy007/32/90893_2.png) [@Amy007](https://discuss.elastic.co/u/Amy007)\
**Post date:** [May 17, 2021, 9:13pm UTC](https://discuss.elastic.co/t/parsing-json-array/273218/4 "2021-05-17T21:13:14Z")

</div>

I wanted to access the inner most fields .

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 17, 2021, 10:33pm UTC](https://discuss.elastic.co/t/parsing-json-array/273218/5 "2021-05-17T22:33:09Z")

</div>

Please do not PM people you do not know.

If you configure

```
    json { source => "message" remove_field => ["message"] }
    split { field => "partyacct" }
    split { field => "[partyacct][accounting]" }
    split { field => "[partyacct][sales]" }
    mutate {
        rename => {
            "[partyacct][accounting][firstName]" => "acctppl_firstname"
            "[partyacct][accounting][lastName]" => "acctppl_lastname"
            "[partyacct][accounting][age]" => "acctppl_age"
            "[partyacct][sales][firstName]" => "salesppl_firstname"
            "[partyacct][sales][lastName]" => "salesppl_lastname"
            "[partyacct][sales][age]" => "salesppl_age"
        }
        remove_field => ["partyacct"]
    }

```

then you will get 8 records like

```
 "acctppl_firstname" => "b36Mary",
  "acctppl_lastname" => "Smith",
      "salesppl_age" => 41,
"salesppl_firstname" => "b36Jim",
       "acctppl_age" => 36,
 "salesppl_lastname" => "Galley"
```

---

<div class="post-metadata">

**Author:** ![Amy007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amy007/32/90893_2.png) [@Amy007](https://discuss.elastic.co/u/Amy007)\
**Post date:** [May 18, 2021, 9:37am UTC](https://discuss.elastic.co/t/parsing-json-array/273218/6 "2021-05-18T09:37:15Z")

</div>

Thank You so much for your help and I tried to run the same but I got truncated error like below. Is it possible that my index space is full or any other issue ?

"firstName""[truncated 253 bytes]; line: 1, column: 1])  
at [Source: (byte)"[  
{

---

<div class="post-metadata">

**Author:** ![Amy007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amy007/32/90893_2.png) [@Amy007](https://discuss.elastic.co/u/Amy007)\
**Post date:** [May 19, 2021, 2:07pm UTC](https://discuss.elastic.co/t/parsing-json-array/273218/9 "2021-05-19T14:07:33Z")

</div>

This is resolved . Thank you very much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2021, 2:07pm UTC](https://discuss.elastic.co/t/parsing-json-array/273218/10 "2021-06-16T14:07:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.