# Process specific dynamic array field from JSON file

**URL:** <https://discuss.elastic.co/t/process-specific-dynamic-array-field-from-json-file/357300>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 12, 2024, 2:40pm UTC](https://discuss.elastic.co/t/process-specific-dynamic-array-field-from-json-file/357300 "2024-04-12T14:40:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gabao-Farias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabao-farias/32/133092_2.png) [@Gabao-Farias](https://discuss.elastic.co/u/Gabao-Farias)\
**Post date:** [April 12, 2024, 2:40pm UTC](https://discuss.elastic.co/t/process-specific-dynamic-array-field-from-json-file/357300/1 "2024-04-12T14:40:22Z")

</div>

Hi people!

Recently I've got in a situation where there is a service that posts it's logs on a single .json file in deeper level field.

The structure is something like this...

```json
{
    "field1": "value1",
    "field2": "value2",
    "field3": "value3",
    "messages": [
        {
            "id": "0x00001",
            "message": "Message 1"
        },
        {
            "id": "0x00002",
            "message": "Message 2"
        },
        {
            "id": "0x00003",
            "message": "Message 3"
        },
        {
            "id": "0x00004",
            "message": "Message 4"
        }
    ]
}

```

So my question is... is there any way that I could read from that sepecific field `messages` with Filebeat?

---

<div class="post-metadata">

**Author:** ![Chadi\_SHWADA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chadi_shwada/32/133224_2.png) [@Chadi\_SHWADA](https://discuss.elastic.co/u/Chadi_SHWADA)\
**Post date:** [April 16, 2024, 12:49pm UTC](https://discuss.elastic.co/t/process-specific-dynamic-array-field-from-json-file/357300/2 "2024-04-16T12:49:00Z")

</div>

Hi

I don't know if that really answers your question, but you need to add that  
to your filebeat.yml file in the "Processors" section following what's already there.

```auto
 - decode_json_fields:
      fields: ['message']
      target: ""

```

Restarts Filebeat.

Tell me if it works

---

<div class="post-metadata">

**Author:** ![Gabao-Farias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabao-farias/32/133092_2.png) [@Gabao-Farias](https://discuss.elastic.co/u/Gabao-Farias)\
**Post date:** [April 16, 2024, 2:28pm UTC](https://discuss.elastic.co/t/process-specific-dynamic-array-field-from-json-file/357300/3 "2024-04-16T14:28:19Z")

</div>

Hi, thanks for the suggestion!

It indeed processes the field `message` relating it's fields all in the same log line, placing several array items as fields in a single log line, now what I was trying to achieve was a little different than this...

What I was trying to do is to separate these array items into several lines of logs via Filebeat (so far couldn't make it)

But if there is no built-in solution for this case, I think I would have to generate another plaintext file from this JSON (via cron or some kind of daemon), separating each item of the array into a compressed JSON to be processed then line by line by filebeat

---

<div class="post-metadata">

**Author:** ![Chadi\_SHWADA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chadi_shwada/32/133224_2.png) [@Chadi\_SHWADA](https://discuss.elastic.co/u/Chadi_SHWADA)\
**Post date:** [April 17, 2024, 9:46am UTC](https://discuss.elastic.co/t/process-specific-dynamic-array-field-from-json-file/357300/4 "2024-04-17T09:46:39Z")

</div>

Oh okay, I understand

I'm a beginner on the ELK stack so I don't know how to help you but good luck