# Remove data from json array in Logstash
**URL:** https://discuss.elastic.co/t/remove-data-from-json-array-in-logstash/54204
**Category:** Logstash
**Created:** [June 28, 2016, 8:58pm UTC](https://discuss.elastic.co/t/remove-data-from-json-array-in-logstash/54204 "2016-06-28T20:58:54Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Geezer](https://discuss.elastic.co/u/Geezer)
#### Post date: [June 28, 2016, 8:58pm UTC](https://discuss.elastic.co/t/remove-data-from-json-array-in-logstash/54204/1 "2016-06-28T20:58:54Z")
I have a data source which is sending in data in json format. Some of this data is held in an array, which makes it difficult to visualize. The array only holds one set of data however.
For example, the "docs" array below:
"field\_1":"**_",
"field\_2":"",
"docs":[{
"alliance\_data\_srstrust":[""],
"alliance\_link\_srstrust":"https://_ **** _",
"alliance\_score\_srstrust":-100,
"alliance\_updated\_srstrust":"2014-10-07T00:29:07Z",
"childproc\_count":1,"cmdline":"C:\WINDOWS\splwow64.exe 8192",
"comms\_ip":"_ ****",
"computer\_name":" ****",
"crossproc\_count":2,
"filemod\_count":2,
"group":"\*\*\*\*\*\*\*\*",
"host\_type":"workstation",
"hostname":" ****",
"id":"0000106f-0000-1aec-01d1-d161694406e2",
"interface\_ip":" **** _",
"last\_update":"2016-06-28T17:20:53.101Z",
"modload\_count":84,
"netconn\_count":0,
"os\_type":"windows",
"parent\_guid":"0000106f-0000-0e88-01d1-d16166a9fb12",
"parent\_md5":"000000000000000000000000000000",
"parent\_name":"acrord32.exe",
"parent\_pid":3720,
"parent\_unique\_id":"0000106f-0000-0e88-01d1-d16166a9fb12-00000001",
"path":"c:\windows\splwow64.exe",
"process\_guid":"0000106f-0000-1aec-01d1-d161694406e2",
"process\_md5":"127AA81343A7C6F665C22CB1293B0A90",
"process\_name":"splwow64.exe",
"process\_pid":6892,
"regmod\_count":9,
"segment\_id":1,
"sensor\_id":4207,
"start":"2016-06-28T17:20:47.855Z",
"unique\_id":"_ ****",
"username":"**\*\*"
}],
I want to be able to remove the name "docs" and the brackets around the "docs" array and be left with a list of fields separated by commas. I tried to do it with this filter but it generates lots of number\_format\_exception errors in the Logstash logs.
The data still seems to load in Elasticsearch but I don't know if it's missing any.
```
if '\"docs\"\:\[' in ["message"] {
mutate {
gsub => [
"message", '\,\"docs\"\:\[\{' , '\,' ,
"message", '\}\]\,' , '\,'
]
}
}
json{
source => "message"
}
```
Is there a better way to extract the data from a single value json array?
And what does number\_format\_exception mean when parsing data in Logstash?
Thank you.
---
### Author:  [@tollef](https://discuss.elastic.co/u/tollef)
#### Post date: [June 30, 2016, 7:37am UTC](https://discuss.elastic.co/t/remove-data-from-json-array-in-logstash/54204/2 "2016-06-30T07:37:59Z")
I'm not sure about the array. But if you want to index something in a nested json you just can apply the json filter twice. It have worked for me at least.
json {
source =\> "message"
}
json {
source =\> "docs"
}
After this you can remove the doc index with a simple mutate -\> remove\_field filter.
---
### Author:  [@Geezer](https://discuss.elastic.co/u/Geezer)
#### Post date: [June 30, 2016, 5:08pm UTC](https://discuss.elastic.co/t/remove-data-from-json-array-in-logstash/54204/3 "2016-06-30T17:08:28Z")
Thanks for the reply. I thought it had worked at first as I was seeing data come in with no errors but it didn't. I still get this in the logstash log:
{:timestamp=\>"2016-06-30T10:21:21.398000-0700", :message=\>"Error parsing json", :source=\>"docs", :raw=\>[{"......"}], :exception=\>java.lang.ClassCastException, :level=\>:warn}
The event is then tagged with \_jsonparsefailure and I don't see the fields from within the array.
---
### Author:  [@Geezer](https://discuss.elastic.co/u/Geezer)
#### Post date: [June 30, 2016, 9:04pm UTC](https://discuss.elastic.co/t/remove-data-from-json-array-in-logstash/54204/4 "2016-06-30T21:04:44Z")
I think I have it now. If the array exists, I split it. I also need to convert one of the fields to a string as we have some wonky data in some events (name instead of number) but this works:
```
if " **********" in [tags] {
json {
source => "message"
}
if [docs] {
split {
field => "[docs]"
add_tag => ["splitted_docs"]
}
mutate {
convert => { "watchlist_id" => "string"}
}
}
date {
match => ["timestamp","UNIX"]
target => "@timestamp"
}
}
```
Cheers
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/remove-data-from-json-array-in-logstash/54204/5 "2017-07-06T04:50:01Z")