Process array elements as objects

I am trying to add json data to my elasticsearch with arrays in its field. My setup works, but I want the arrays to become separate fields. Is this possible in logstash or should i create a json parser to fix my problem?

	"name": "peter",
	"occupation": "salesman",
	"score": [{
			"result": true,
			"name": "reported"
			"result": false,
			"name": "processed"
	"level": 38,
	"categories": [{
			"category": "owner",
			"passed": false
			"category": "worker",
			"passed": true

My config file:

input { stdin {}

filter {
        json {
                source => "message"
                target => "message"


output {
        elasticsearch {
                hosts => ["IP:9200"]
                        index => "worker"
                        document_id => "%{message}"
                        doc_as_upsert => true
                        action => "update"
                        retry_on_conflict => 10

I want the arrays to become separate fields

I don't understand what you mean by this. Please give an example of the JSON document you want to get.

Why are you using the message field as ID?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.