# Parsing json object

**URL:** <https://discuss.elastic.co/t/parsing-json-object/267446>\
**Category:** Logstash\
**Created:** [March 17, 2021, 5:59am UTC](https://discuss.elastic.co/t/parsing-json-object/267446 "2021-03-17T05:59:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hackercat](https://avatars.discourse-cdn.com/v4/letter/h/71e660/32.png) [@hackercat](https://discuss.elastic.co/u/hackercat)\
**Post date:** [March 17, 2021, 5:59am UTC](https://discuss.elastic.co/t/parsing-json-object/267446/1 "2021-03-17T05:59:46Z")

</div>

Hi there,

If someone can help me with this I would be very appreciated. It's so complicated for me. So I have an event like this

```auto
{
   "time":"2021-03-12T00:40:57.016Z",
   "severity":"INFO",
   "duration_s":0.02124,
   "db_duration_s":0.00624,
   "view_duration_s":0.015,
   "status":204,
   "method":"POST",
   "path":"/api/v4/jobs/request",
   "params":[
      {
         "key":"info",
         "value":{
            "name":"gitlab-runner",
            "version":"13.9.0",
            "revision":"2ebc4dc4",
            "platform":"linux",
            "architecture":"amd64",
            "executor":"docker",
            "shell":"bash",
            "features":{
               "variables":"[FILTERED]",
               "image":null,
               "services":null,
               "artifacts":null,
               "cache":null,
               "shared":null,
               "upload_multiple_artifacts":null,
               "upload_raw_artifacts":null,
               "session":null,
               "terminal":null,
               "refspecs":null,
               "masking":null,
               "proxy":null,
               "raw_variables":"[FILTERED]",
               "artifacts_exclude":null,
               "multi_build_steps":null,
               "trace_reset":"[FILTERED]",
               "trace_checksum":"[FILTERED]",
               "trace_size":"[FILTERED]",
               "vault_secrets":"[FILTERED]",
               "cancelable":null,
               "return_exit_code":null
            }
         }
      },
      {
         "key":"token",
         "value":"[FILTERED]"
      },
      {
         "key":"last_update",
         "value":"850530bed1cfb46fc50f5ac9d0279288"
      }
   ],
   "ua":"gitlab-runner 13.9.0 (13-9-stable; go1.13.8; linux/amd64)",
   "route":"/api/:version/jobs/request",
   "queue_duration_s":0.00724,
   "redis_calls":5,
   "redis_duration_s":0.002841,
   "correlation_id":"62YEwxh9m9a",
   "meta.caller_id":"/api/:version/jobs/request"
}

```

I want to get something like if [params][value][name] = gitlab-runner, then put the whole params.value under root.

It will be like

```auto
"time":"2021-03-12T00:40:57.016Z",
"severity":"INFO",
"duration_s":0.02124,
"db_duration_s":0.00624,
"view_duration_s":0.015,
"status":204,
"method":"POST",
"path":"/api/v4/jobs/request",
"info. name": "gitlab-runner"
"info.version":"13.9.0"
...

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 17, 2021, 4:45pm UTC](https://discuss.elastic.co/t/parsing-json-object/267446/2 "2021-03-17T16:45:33Z")

</div>

> [@hackercat](#):
>
> [params][value][name]

[params] is an array, so that would be [params][0][value][name]

You can use a ruby filter to move fields to the root. An example is [here](https://discuss.elastic.co/t/how-to-dynamically-move-nested-key-value-to-root-level/180006/2).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2021, 4:17am UTC](https://discuss.elastic.co/t/parsing-json-object/267446/4 "2021-04-20T04:17:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.