# Parsing JSON with a string at the beginning of each JSON Object
**URL:** https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480
**Category:** Logstash
**Created:** [September 29, 2021, 1:24pm UTC](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480 "2021-09-29T13:24:56Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@pkward](https://discuss.elastic.co/u/pkward)
#### Post date: [September 29, 2021, 1:24pm UTC](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480/1 "2021-09-29T13:24:56Z")
Hello,
I'm trying to parse a json file with a string at the beginning of each object. What is the easiest way to bypass the initial string or parse the json with string at the beginning?
Here is an example of the JSON:
string {"field": "value"}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 29, 2021, 2:00pm UTC](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480/2 "2021-09-29T14:00:13Z")
Use mutate+gsub to remove the string.
---
### Author:  [@pkward](https://discuss.elastic.co/u/pkward)
#### Post date: [September 29, 2021, 2:15pm UTC](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480/3 "2021-09-29T14:15:46Z")
Thanks @Badger. Second question would the string be considered the source or message?
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [September 29, 2021, 2:23pm UTC](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480/4 "2021-09-29T14:23:22Z")
```auto
filter {
mutate {
gsub => ["message", "string ", ""]
}
json {
source => "message"
}
}
```
---
### Author:  [@pkward](https://discuss.elastic.co/u/pkward)
#### Post date: [September 29, 2021, 2:27pm UTC](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480/5 "2021-09-29T14:27:59Z")
Ok, I have something similar. To give context the strings are domain names and they're all different. I'm trying to use regex, but every domain is different including numbers with text, just numbers, or just text.
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [September 29, 2021, 2:34pm UTC](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480/6 "2021-09-29T14:34:58Z")
If there is always a space after the text `domainname {` then an easy option is to just grok after that first space.
```auto
filter {
grok {
match => { "message" => " %{GREEDYDATA:new_message}" }
}
json {
source => "new_message"
}
mutate {
remove_field => ["new_message", "message"]
}
}
```
**Output**
```auto
{
"@timestamp" => 2021-09-29T14:33:23.008Z,
"field" => "value"
}
```
---
### Author:  [@pkward](https://discuss.elastic.co/u/pkward)
#### Post date: [September 29, 2021, 2:42pm UTC](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480/7 "2021-09-29T14:42:56Z")
I'm giving it a try right now.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [September 29, 2021, 2:57pm UTC](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480/8 "2021-09-29T14:57:03Z")
If you always have this format:
```auto
string1 {json}
string2 {json}
string3 {json}
```
You could also use a dissect filter to split your message in two parts.
```auto
dissect {
mapping => {
"message" => "%{domainName} %{jsonData}"
}
}
```
So for the following example:
```auto
string1 {"field": "value"}
```
This dissect filter will create two fields:
```auto
domainName: "string1"
jsonData: {"field": "value"}
```
Then you can use the `json` fitler with the `jsonData` field.
This is similar to the `grok` example, but `dissect` uses less CPU.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 27, 2021, 2:57pm UTC](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480/9 "2021-10-27T14:57:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.