# Parsing only a limited set of fields in JSON
**URL:** https://discuss.elastic.co/t/parsing-only-a-limited-set-of-fields-in-json/133885
**Category:** Logstash
**Created:** [May 30, 2018, 2:05pm UTC](https://discuss.elastic.co/t/parsing-only-a-limited-set-of-fields-in-json/133885 "2018-05-30T14:05:28Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@dr01](https://discuss.elastic.co/u/dr01)
#### Post date: [May 30, 2018, 2:05pm UTC](https://discuss.elastic.co/t/parsing-only-a-limited-set-of-fields-in-json/133885/1 "2018-05-30T14:05:28Z")
I need to parse a JSON log message but keep only a few fields. Is it possible to couple the JSON filter plugin ([https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html)) with the KV filter plugin ([https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html)) to do so?
My idea was to use the include\_keys command from KV.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 30, 2018, 2:22pm UTC](https://discuss.elastic.co/t/parsing-only-a-limited-set-of-fields-in-json/133885/2 "2018-05-30T14:22:22Z")
No, you can't do that. Perhaps the prune filter can be useful.
---
### Author:  [@dr01](https://discuss.elastic.co/u/dr01)
#### Post date: [May 30, 2018, 2:48pm UTC](https://discuss.elastic.co/t/parsing-only-a-limited-set-of-fields-in-json/133885/3 "2018-05-30T14:48:07Z")
That's what I feared. Here's my (non-working) attempt to keep only the JSON keys "foo" and "bar":
```
filter {
json {
source => "message"
target => "mylog"
remove_field => ["message", "source", "fields", "[mylog][@version]", "[mylog][type]" ]
}
kv {
source => "message"
field_split => ","
value_split => ":"
include_keys => ["mylog.@fields.foo", "mylog.@fields.bar"]
}
}
```
This filter parses correctly the JSON but includes all values, which isn't what I want.
I'll try the prune filter. Thanks for now.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 30, 2018, 6:22pm UTC](https://discuss.elastic.co/t/parsing-only-a-limited-set-of-fields-in-json/133885/4 "2018-05-30T18:22:39Z")
Prune should work, but you could also copy the fields out of [mylog] then delete it.
```
mutate { copy => { "[mylog][foo]" => "foo" "[mylog][bar]" => "bar" } }
mutate { remove_field => ["[mylog]" ] }
mutate { rename => { "foo" => "[mylog][foo]" "bar" => "[mylog][bar]" } }
```
---
### Author:  [@dr01](https://discuss.elastic.co/u/dr01)
#### Post date: [May 31, 2018, 9:17am UTC](https://discuss.elastic.co/t/parsing-only-a-limited-set-of-fields-in-json/133885/5 "2018-05-31T09:17:42Z")
Thank you all. I managed to do what I wanted. Here's the final code:
```
filter {
json {
source => "message"
target => "mylog"
remove_field => ["message", "source", "fields", "[mylog][@version]", "[mylog][type]" ]
}
kv {
source => "message"
field_split => ","
value_split => ":"
}
date {
match => ["[mylog][@timestamp]", "ISO8601" ]
remove_field => ["[mylog][@timestamp]" ]
}
mutate {
copy => { "[mylog][@fields][type]" => "mylog_type" }
copy => { "[mylog][@fields][action]" => "mylog_action" }
remove_field => ["[mylog]" ]
}
}
```
There's probably redundancy between the `json` and the `kv` code so some parts could be ditched out. Also, `remove_field => ["[mylog][@timestamp]" ]` is unnecessary as the filter removes the whole `[mylog]` field further on. Feel free to share your thoughts.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 28, 2018, 9:17am UTC](https://discuss.elastic.co/t/parsing-only-a-limited-set-of-fields-in-json/133885/6 "2018-06-28T09:17:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.