# Parsing nested json object and make as a single filed
**URL:** https://discuss.elastic.co/t/parsing-nested-json-object-and-make-as-a-single-filed/139732
**Category:** Logstash
**Created:** [July 12, 2018, 10:39am UTC](https://discuss.elastic.co/t/parsing-nested-json-object-and-make-as-a-single-filed/139732 "2018-07-12T10:39:03Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Charan\_Adabala](https://discuss.elastic.co/u/Charan_Adabala)
#### Post date: [July 12, 2018, 10:39am UTC](https://discuss.elastic.co/t/parsing-nested-json-object-and-make-as-a-single-filed/139732/1 "2018-07-12T10:39:03Z")
I have a log file that's an array of objects that looks something like this:
[
{
"cate1": "data1a",
"cate2": "data2a"
},
{
"cate1": "data1b",
"cate2": "data2b"
}
]
but I need output like this can you help me please.
I want to concatenate the first object and second object, can you please help me.
**Desired output:**
**_"concatenate\_fileds" : "data1a,data2a ## data1b,data2b"_**
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 12, 2018, 5:00pm UTC](https://discuss.elastic.co/t/parsing-nested-json-object-and-make-as-a-single-filed/139732/2 "2018-07-12T17:00:10Z")
Apologies if my ruby coding style makes your eyeballs bleed, but
```
ruby {
code => '
r = ""
event.get("message").each { |x|
s = ""
x.each { |k, v|
s += v + ","
}
r += s + "##"
}
event.set("concatenate_fields", r)
'
}
mutate { gsub => ["concatenate_fields", "[#,]+$", "" ] }
```
---
### Author:  [@Charan\_Adabala](https://discuss.elastic.co/u/Charan_Adabala)
#### Post date: [July 13, 2018, 3:39am UTC](https://discuss.elastic.co/t/parsing-nested-json-object-and-make-as-a-single-filed/139732/3 "2018-07-13T03:39:42Z")
Thanks for previous comment, Its help full for me. Can you please help me for below question:
I have this type event
```
"json": {
"events": [{
"parentPid": 8640,
"eventType": "SYSTEM_API_CALL",
"userName": "CABLE\\tmorte000",
"policyState": "NOT_APPLIED",
"killChainStatus": "INSTALL_RUN",
"processId": 2704,
"eventTime": 1530460682534,
"parentHash": "6da8936fe2ca57ef9113bff6b28b10bd37c72097320c972cc8147666ba41fe48",
"commandLine": "ACSR.EXE PAZRUSS -execacsr EXECACSR-8640 "
}, {
"parentPid": 8640,
"eventType": "INJECT_CODE",
"userName": "CABLE\\tmorte000",
"policyState": "NOT_APPLIED",
"processMd5Hash": "2329937bd244abc692fb8e5a4e21067a",
"killChainStatus": "DELIVER_EXPLOIT",
"processId": 2704,
"eventTime": 1530460682533,
"parentHash": "6da8936fe2ca57ef9113bff6b28b10bd37c72097320c972cc8147666ba41fe48",
"commandLine": "ACSR.EXE PAZRUSS -execacsr EXECACSR-8640 "
}]
}
```
I need to parse some fields from this events array, fields are "parentPid","eventType","policyState".
**Desired output:**
"output\_fileds":"8640,SYSTEM\_API\_CALL,NOT\_APPLIED ## 8640,INJECT\_CODE,NOT\_APPLIED"
Can you please help me on this.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 13, 2018, 2:55pm UTC](https://discuss.elastic.co/t/parsing-nested-json-object-and-make-as-a-single-filed/139732/4 "2018-07-13T14:55:21Z")
OK, so just change the core of the loop to be
```
event.get("[json][events]").each { |x|
s = x["parentPid"].to_s + "," + x["eventType"] + "," + x["policyState"]
r += s + "##"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 10, 2018, 2:55pm UTC](https://discuss.elastic.co/t/parsing-nested-json-object-and-make-as-a-single-filed/139732/5 "2018-08-10T14:55:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.