# Parsing nested arrays in json objects

**URL:** https://discuss.elastic.co/t/parsing-nested-arrays-in-json-objects/156944
**Category:** Logstash
**Created:** [November 15, 2018, 9:38pm UTC](https://discuss.elastic.co/t/parsing-nested-arrays-in-json-objects/156944 "2018-11-15T21:38:12Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![alexmartin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexmartin/32/37692_2.png) [@alexmartin](https://discuss.elastic.co/u/alexmartin)
#### Post date: [November 15, 2018, 9:38pm UTC](https://discuss.elastic.co/t/parsing-nested-arrays-in-json-objects/156944/1 "2018-11-15T21:38:12Z")

</div>

I'm trying to parse lines of json from Filebeat log files to Logstash to Elasticstack.

The problem I'm having is that some of these lines contains nested arrays in json objects.

Here's a sample (prettified):

```
{
  "EventTime": "2018-11-15T16:47:37.8053627+00:00",
  "ThreadId": 46,
  "LogEntryType": "Info",
  "Context": "Application.Sample",
  "MeaningCode": "LOGIN",
  "UserId": 13,
  "LoggedObjects": [
    {
      "ExternalSystemVersion": "Sample Ext",
      "Extension": "0",
      "UnderlyingTask": ".",
      "CurrentTask": "Sample",
      "UserName": "User",
      "TaskManagerId": "eed19b9a-47b4-42f3-ac83-38f6e5a27fef"
    }
  ],
  "LoggedException": null
}

```

The array here being 'LoggedObjects'.

In the logstash config I've tried using the json filter like:

```
input {
  beats {
    port => 5044
    codec => "json"
  }
}

filter {
  if ([LogEntryType] =~ "Info") {
    json {
      source => "LoggedObjects"
      target => "log"
    }
  }
}

```

But I get an exception:  
`:exception=>java.lang.ClassCastException: org.jruby.RubyArray cannot be cast to org.jruby.RubyIO`

With the current versions of Filebeat and Logstash (6.5) what is the best way to deserialize(?) this so that they appear as separate fields in Kibana and not just one object?

Thanks  
Alex

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 13, 2018, 9:49pm UTC](https://discuss.elastic.co/t/parsing-nested-arrays-in-json-objects/156944/2 "2018-12-13T21:49:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.