# Split Json Array Objects

**URL:** <https://discuss.elastic.co/t/split-json-array-objects/223088>\
**Category:** Logstash\
**Created:** [March 11, 2020, 9:49am UTC](https://discuss.elastic.co/t/split-json-array-objects/223088 "2020-03-11T09:49:16Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\
**Post date:** [March 11, 2020, 9:49am UTC](https://discuss.elastic.co/t/split-json-array-objects/223088/1 "2020-03-11T09:49:16Z")

</div>

Hi,  
I want to split my json array into multiple events in logstash. I tried using split field but it doesn't seem to work that way for objects in array. So any reference which plugin should I use in logstash to process data. Data format is given below:

{ "problems": [{  
"Diabetes": [{  
"medications": [{  
"medicationsClasses": [{  
"className": [{  
"associatedDrug": [{  
"name": "asprin",  
"dose": "",  
"strength": "500 mg"  
}],  
"associatedDrug#2": [{  
"name": "somethingElse",  
"dose": "",  
"strength": "500 mg"  
}]  
}],  
"className2": [{  
"associatedDrug": [{  
"name": "asprin",  
"dose": "",  
"strength": "500 mg"  
}],  
"associatedDrug#2": [{  
"name": "somethingElse",  
"dose": "",  
"strength": "500 mg"  
}]  
}]  
}]  
}]  
}]  
}]  
}

Expected result : 4 different document containing

1. 

{ "problems": [{  
"Diabetes": [{  
"medications": [{  
"medicationsClasses": [{  
"className": [{  
"associatedDrug": [{  
"name": "asprin",  
"dose": "",  
"strength": "500 mg"  
}]  
}]  
}]  
}]  
}]  
}]  
}

1. 

{ "problems": [{  
"Diabetes": [{  
"medications": [{  
"medicationsClasses": [{  
"className": [{  
"associatedDrug#2": [{  
"name": "somethingElse",  
"dose": "",  
"strength": "500 mg"  
}]  
}]  
}]  
}]  
}]  
}]  
}

1. 

{ "problems": [{  
"Diabetes": [{  
"medications": [{  
"medicationsClasses": [{  
"className2": [{  
"associatedDrug": [{  
"name": "asprin",  
"dose": "",  
"strength": "500 mg"  
}]  
}]  
}]  
}]  
}]  
}]  
}

1. 

{ "problems": [{  
"Diabetes": [{  
"medications": [{  
"medicationsClasses": [{  
"className2": [{  
"associatedDrug#2": [{  
"name": "somethingElse",  
"dose": "",  
"strength": "500 mg"  
}]  
}]  
}]  
}]  
}]  
}]  
}

Expected Document is each associatedDrug in separate doc  
Thanks!

---

<div class="post-metadata">

**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\
**Post date:** [March 11, 2020, 10:33am UTC](https://discuss.elastic.co/t/split-json-array-objects/223088/2 "2020-03-11T10:33:25Z")

</div>

Hi

Which field do you want to split? What is exactly what you want to get? Could you please provide a sample of the expected result from the data sample you posted?

Thanks.

---

<div class="post-metadata">

**Author:** ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\
**Post date:** [March 11, 2020, 11:32am UTC](https://discuss.elastic.co/t/split-json-array-objects/223088/3 "2020-03-11T11:32:15Z")

</div>

I updated the expected outcome.

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [March 11, 2020, 11:52am UTC](https://discuss.elastic.co/t/split-json-array-objects/223088/4 "2020-03-11T11:52:50Z")

</div>

> [@Atul\_Gunjal](#):
>
> {  
> "Diabetes": [{  
> "medications": [{  
> "medicationsClasses": [{  
> "className": [{  
> "associatedDrug": [{  
> "name": "asprin",  
> "dose": "",  
> "strength": "500 mg"  
> }

Please, make use of the **`Preformatted text`** tool ( ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2f9cdd1942d417d21d664063fd4fd14fa0799ae7.png) ) to format your content or it'll be unreadable.

```
{
  "this_is": "a readable json"
}

```

{  
"this\_is":"garbage"  
}

---

<div class="post-metadata">

**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\
**Post date:** [March 11, 2020, 1:04pm UTC](https://discuss.elastic.co/t/split-json-array-objects/223088/5 "2020-03-11T13:04:08Z")

</div>

Hi

It is not clear to me that you can easily get what you get, but, off the top of my head, I think you could split by the `medicationsClasses` field and then use an `if` statement on the existence of either the `className` or the `className2` fields to split again by that field. Something similar to this:

```auto
    split {
      field => "[problems][Diabetes][medications][medicationsClasses]"
    }
    if [className] {
      split {
        field => "[problems][Diabetes][medications][medicationsClasses][className]"
      }
    }
    else if [className2] {
      split {
        field => "[problems][Diabetes][medications][medicationsClasses][className2]"
      }
    }

```

You might have to first split by `problems`, and then, for each possible value of `problems` (Diabetes, etc...), split again for `medicationsClasses` as I suggested above.

Maybe you don't have to split so may times, only once for `className` and once for `classname2`, but you'll need the `if` statements to discern when to split by one and when by the other.

Hope this helps

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [March 11, 2020, 3:10pm UTC](https://discuss.elastic.co/t/split-json-array-objects/223088/6 "2020-03-11T15:10:04Z")

</div>

Mhmh I have a feeling you cannot do the first `split` since it'll find nothing at first in `[problems][Diabetes][medications][medicationsClasses]`.

To do what you suggested he should do something like first splitting `[problems]`, then if `[problems][Diabetes]` exists (not only `[Diabetes]` because when you split something with logstash it'll keep the root field and nest the split fields inside it) split `[problems][Diabetes]`, then if `[problems][Diabetes][medications]` exists split `[problems][Diabetes][medications]` etc...

That of course is not a scalable approach. If you want to apply that solution to an event with a slightly different internal structure, it'll break.

I'd probably go with a recursive solution on the top event using the ruby filter.

---

<div class="post-metadata">

**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\
**Post date:** [March 12, 2020, 7:02am UTC](https://discuss.elastic.co/t/split-json-array-objects/223088/7 "2020-03-12T07:02:50Z")

</div>

Hi @Fabio-sama

You are absolutely right. I was also thinking that, with the proper `if` statements in place and assuming he receives one `problem` per event, @Atul_Gunjal might be able to split only once, by either `className` or `className2`. Of course this is not a general solution, and it requires that he knows in advance all the possible `problems`.

The `ruby{}` filter option did cross my mind but my ruby skills, in a scale from 1 to 10, are close to -5 😉 If he is good at ruby he might want to try that approach, but I believe it can be done with just native `logstash` for this particular case. If a more general solution is desired, I agree with you that a `ruby{}` filter is most likely the way to go.

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [March 12, 2020, 7:22am UTC](https://discuss.elastic.co/t/split-json-array-objects/223088/8 "2020-03-12T07:22:05Z")

</div>

> my ruby skills, in a scale from 1 to 10, are close to -5 😉

🤣 🤣

Well, I usually tend to adopt as general solutions as possible, since I don't like to be strictly linked to the shape of one specific log.

Though, if he only needs it for this very specific case, he could do something very similar to what you wrote, like:

```
split {
  field => "[problems]"
}

split {
  field => "[problems][Diabetes]"
}

split {
  field => "[problems][Diabetes][medications]"
}

split {
  field => "[problems][Diabetes][medications][medicationsClasses]
}

...and so on ...

```

Anyway, should I find 10 minutes today, I'll write a general ruby filter to accomplish such a task. Also because it might be useful to future readers as well.

---

<div class="post-metadata">

**Author:** ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\
**Post date:** [March 18, 2020, 4:03am UTC](https://discuss.elastic.co/t/split-json-array-objects/223088/9 "2020-03-18T04:03:21Z")

</div>

This method works for me...Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 15, 2020, 4:03am UTC](https://discuss.elastic.co/t/split-json-array-objects/223088/10 "2020-04-15T04:03:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.