# \[SOLVED\] Split filter question a.k.a flatten json sub array

**URL:** https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481
**Category:** Logstash
**Created:** [May 3, 2018, 2:53pm UTC](https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481 "2018-05-03T14:53:55Z")
**Posts on this page:** 1
**Showing post:** 10

<div class="post-metadata">

### Author: ![blastik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blastik/32/30764_2.png) [@blastik](https://discuss.elastic.co/u/blastik)
#### Post date: [May 3, 2018, 6:00pm UTC](https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481/10 "2018-05-03T18:00:46Z")

</div>

let me add that the json looks more like this, so it contains several objects

> [{  
> "Action": "COUNT",  
> "Timestamp": "2018-05-02T15:36:14Z",  
> "Request": {  
> "Country": "PT",  
> "URI": "/uploadMultiplePhotos.aspx",  
> "Headers": [{  
> "Name": "Host",  
> "Value": "[www.example.net](http://www.example.net)"  
> }, {  
> "Name": "Content-Length",  
> "Value": "175253"  
> }, {  
> "Name": "origin",  
> "Value": "[https://www.example.net](https://www.example.net)"  
> }, {  
> "Name": "user-agent",  
> "Value": "Mozilla/5.0 (Linux; Android 7.0; LG-M200 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.126 Mobile Safari/537.36"  
> }, {  
> "Name": "content-type",  
> "Value": "multipart/form-data; boundary=----WebKitFormBoundaryXBuUMINHBoY9jHwN"  
> }, {  
> "Name": "accept",  
> "Value": "application/json"  
> }, {  
> "Name": "cache-control",  
> "Value": "no-cache"  
> }, {  
> "Name": "x-requested-with",  
> "Value": "XMLHttpRequest"  
> }, {  
> "Name": "save-data",  
> "Value": "on"  
> }, {  
> "Name": "x-ajax",  
> "Value": "blabla"  
> }, {  
> "Name": "referer",  
> "Value": "[https://www.example.net/blabla](https://www.example.net/blabla)"  
> }, {  
> "Name": "accept-encoding",  
> "Value": "gzip, deflate, br"  
> }, {  
> "Name": "accept-language",  
> "Value": "pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7,es;q=0.6"  
> }, {  
> "Name": "cookie",  
> "Value": "blabla"  
> }],  
> "ClientIP": "8.8.8.8",  
> "Method": "POST",  
> "HTTPVersion": "HTTP/2.0"  
> },  
> "Weight": 1  
> },{  
> "Action": "COUNT",  
> "Timestamp": "2018-05-02T15:36:14Z",  
> "Request": {  
> "Country": "PT",  
> "URI": "/uploadMultiplePhotos.aspx",  
> "Headers": [{  
> "Name": "Host",  
> "Value": "[www.example.net](http://www.example.net)"  
> }, {  
> "Name": "Content-Length",  
> "Value": "175253"  
> }, {  
> "Name": "origin",  
> "Value": "[https://www.example.net](https://www.example.net)"  
> }, {  
> "Name": "user-agent",  
> "Value": "Mozilla/5.0 (Linux; Android 7.0; LG-M200 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.126 Mobile Safari/537.36"  
> }, {  
> "Name": "content-type",  
> "Value": "multipart/form-data; boundary=----WebKitFormBoundaryXBuUMINHBoY9jHwN"  
> }, {  
> "Name": "accept",  
> "Value": "application/json"  
> }, {  
> "Name": "cache-control",  
> "Value": "no-cache"  
> }, {  
> "Name": "x-requested-with",  
> "Value": "XMLHttpRequest"  
> }, {  
> "Name": "save-data",  
> "Value": "on"  
> }, {  
> "Name": "x-ajax",  
> "Value": "blabla"  
> }, {  
> "Name": "referer",  
> "Value": "[https://www.example.net/blabla](https://www.example.net/blabla)"  
> }, {  
> "Name": "accept-encoding",  
> "Value": "gzip, deflate, br"  
> }, {  
> "Name": "accept-language",  
> "Value": "pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7,es;q=0.6"  
> }, {  
> "Name": "cookie",  
> "Value": "blabla"  
> }],  
> "ClientIP": "8.8.8.8",  
> "Method": "POST",  
> "HTTPVersion": "HTTP/2.0"  
> },  
> "Weight": 1  
> },{  
> "Action": "COUNT",  
> "Timestamp": "2018-05-02T15:36:14Z",  
> "Request": {  
> "Country": "PT",  
> "URI": "/uploadMultiplePhotos.aspx",  
> "Headers": [{  
> "Name": "Host",  
> "Value": "[www.example.net](http://www.example.net)"  
> }, {  
> "Name": "Content-Length",  
> "Value": "175253"  
> }, {  
> "Name": "origin",  
> "Value": "[https://www.example.net](https://www.example.net)"  
> }, {  
> "Name": "user-agent",  
> "Value": "Mozilla/5.0 (Linux; Android 7.0; LG-M200 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.126 Mobile Safari/537.36"  
> }, {  
> "Name": "content-type",  
> "Value": "multipart/form-data; boundary=----WebKitFormBoundaryXBuUMINHBoY9jHwN"  
> }, {  
> "Name": "accept",  
> "Value": "application/json"  
> }, {  
> "Name": "cache-control",  
> "Value": "no-cache"  
> }, {  
> "Name": "x-requested-with",  
> "Value": "XMLHttpRequest"  
> }, {  
> "Name": "save-data",  
> "Value": "on"  
> }, {  
> "Name": "x-ajax",  
> "Value": "blabla"  
> }, {  
> "Name": "referer",  
> "Value": "[https://www.example.net/blabla](https://www.example.net/blabla)"  
> }, {  
> "Name": "accept-encoding",  
> "Value": "gzip, deflate, br"  
> }, {  
> "Name": "accept-language",  
> "Value": "pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7,es;q=0.6"  
> }, {  
> "Name": "cookie",  
> "Value": "blabla"  
> }],  
> "ClientIP": "8.8.8.8",  
> "Method": "POST",  
> "HTTPVersion": "HTTP/2.0"  
> },  
> "Weight": 1  
> }]

---

_[View the full topic](https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481)._