# Parsing JSON? output from web service

**URL:** <https://discuss.elastic.co/t/parsing-json-output-from-web-service/198170>\
**Category:** Logstash\
**Created:** [September 5, 2019, 6:41am UTC](https://discuss.elastic.co/t/parsing-json-output-from-web-service/198170 "2019-09-05T06:41:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vspies](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vspies/32/53605_2.png) [@vspies](https://discuss.elastic.co/u/vspies)\
**Post date:** [September 5, 2019, 6:41am UTC](https://discuss.elastic.co/t/parsing-json-output-from-web-service/198170/1 "2019-09-05T06:41:08Z")

</div>

We are polling a security web service to get the scanning and detection logs.

This is what I get when I poll the service with logstash:

```
{
                 "current_link" => "https://xxx/v1/siem/security_events?service=exchange&event=securityrisk",
                   "@timestamp" => 2019-09-05T00:17:30.019Z,
"last_log_item_generation_time" => "2019-09-05T00:15:59.000Z",
                      "traceId" => "aa157e14-b5c4-44ed-a12f-230f42ce4e2d",
                     "@version" => "1",
                    "next_link" => "",
              "security_events" => [
    [0] {
            "message" => {
                  "mail_message_subject" => "Zakończenie konkursu - Wygraj bilety do kina",
                    "security_risk_name" => "Other spam",
                           "detected_by" => "Antispam engine",
                         "affected_user" => "xxx",
             "triggered_security_filter" => "Advanced Spam Protection",
                       "mail_message_id" => "<xxx>",
                         "action_result" => "success",
                             "scan_type" => "Real-time scan",
                            "risk_level" => "",
                              "location" => "xxx",
                 "triggered_policy_name" => "Default Exchange Policy ATP",
                        "detection_time" => "2019-09-05T00:15:59.000Z",
                "mail_message_file_name" => "",
                                "action" => "Move to Junk Email folder",
                "mail_message_recipient" => [
                [0] "\"xxx\"<xxx>"
            ],
              "mail_message_submit_time" => "2019-09-05T00:15:54.000Z",
            "mail_message_delivery_time" => "2019-09-05T00:01:31.000Z",
                   "mail_message_sender" => "\"xxx\"xxx>"
        },
            "service" => "Exchange Online",
              "event" => "security_risk_scan",
        "log_item_id" => "TyDH_mwBsV0XoBdHJoOn"
    }
[1] {
            "message" => {
                  "mail_message_subject" => "xxx",
                    "security_risk_name" => "Other spam",
                           "detected_by" => "Antispam engine",
                         "affected_user" => "xxx",
             "triggered_security_filter" => "Advanced Spam Protection",
                       "mail_message_id" => "<xxx>",
                         "action_result" => "success",
                             "scan_type" => "Real-time scan",
                            "risk_level" => "",
                              "location" => "xxx",
                 "triggered_policy_name" => "Default Exchange Policy ATP",
                        "detection_time" => "2019-09-05T00:18:45.000Z",
                "mail_message_file_name" => "",
                                "action" => "Move to Junk Email folder",
                "mail_message_recipient" => [
                [0] "\"xxx\"<xxx>"
            ],
              "mail_message_submit_time" => "2019-09-05T00:18:38.000Z",
            "mail_message_delivery_time" => "2019-09-05T00:14:06.000Z",
                   "mail_message_sender" => "\"xxx\"<xxx>"
        },
            "service" => "Exchange Online",
              "event" => "security_risk_scan",
        "log_item_id" => "_YzJ_mwBhwpaNQMzrmMf"
    }
]}

```

I have quite a bit expirience with logstash and plain logs, but I have no idea how to parse this JSON? construct.

One of the problems is that we are parsing the web service so the security\_events filed can contain variuos entries.

What I like to accomplish is that I get one elasticsearch entry for every entry in the security\_events field.

---

<div class="post-metadata">

**Author:** ![tobydickinson](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@tobydickinson](https://discuss.elastic.co/u/tobydickinson)\
**Post date:** [September 5, 2019, 8:29am UTC](https://discuss.elastic.co/t/parsing-json-output-from-web-service/198170/2 "2019-09-05T08:29:47Z")

</div>

What you want is the Split filter plugin. There is some good documentation for this on the Elastic website.

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 3, 2019, 8:42am UTC](https://discuss.elastic.co/t/parsing-json-output-from-web-service/198170/3 "2019-10-03T08:42:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.