# Splitting an array of objects using Logstash
**URL:** https://discuss.elastic.co/t/splitting-an-array-of-objects-using-logstash/349066
**Category:** Logstash
**Created:** [December 11, 2023, 3:58pm UTC](https://discuss.elastic.co/t/splitting-an-array-of-objects-using-logstash/349066 "2023-12-11T15:58:50Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@M0hsen](https://discuss.elastic.co/u/M0hsen)
#### Post date: [December 11, 2023, 3:58pm UTC](https://discuss.elastic.co/t/splitting-an-array-of-objects-using-logstash/349066/1 "2023-12-11T15:58:50Z")
Hello everyone,
I'm trying to split the following array of objects into multiple log events:
```auto
[
{
"time": "*",
"twkMessageId": "*",
"environmentName": "*",
"virtualhostName": "default",
"apiproxyName": "*",
"proxyBasepath": "*",
"uri": "*",
"clientIp": "*",
"clientCountry": null,
"clientHost": "*",
"currentFlowName": "PreFlow",
"logLevel": "INFO",
"logMessage": {
"httpStatusCode": "",
"verb": "POST",
"target": "",
"targetUri": "",
"clientFirstName": "",
"clientLastName": "",
"clientUsername": "",
"clientEmail": "",
"productName": "",
"appId": "",
"appName": "",
"appStatus": "",
"appExpiresAt": "",
"headers": {
"Accept": " ****",
"Accept-Encoding": " ****",
"Access-Control-Allow-Credentials": " ****",
"Access-Control-Allow-Headers": " ****",
"Access-Control-Allow-Methods": " ****",
"Access-Control-Allow-Origin": " ****",
"Access-Control-Max-Age": " ****",
"Authorization": " ****",
"Content-Length": " ****",
"Content-Type": " ****",
"Host": " ****",
"Postman-Token": " ****",
"User-Agent": " ****",
"X-Content-Type-Options": " ****",
"X-Forwarded-For": " ****",
"X-Forwarded-Port": " ****",
"X-Forwarded-Proto": " ****",
"X-XSS-Protection": " ****"
},
"hashedHeaders": "*",
"queryParams": "",
"payload": {
"post.statusId": " ****",
"post.body": " ****",
"post.mediaId": " ****",
"post.actions.0.id": " ****",
"post.actions.0.order": " ****",
"post.actions.0.label": " ****",
"post.actions.0.params.0.key": " ****",
"post.actions.0.params.0.value": " ****",
"post.actions.0.value": " ****"
},
"hashedPayload": "*",
"organizationName": "*",
"clientReceivedStartTime": "*",
"clientReceivedEndTime": "*",
"duration": 5,
"status": ""
}
},
{
"time": "*",
"twkMessageId": "*",
"environmentName": "*",
"virtualhostName": "*",
"apiproxyName": "*",
"proxyBasepath": "*",
"uri": "*",
"clientIp": "*",
"clientCountry": null,
"clientHost": "*",
"currentFlowName": "PostFlow",
"logLevel": "INFO",
"logMessage": {
"httpStatusCode": "",
"verb": "POST",
"target": "*",
"targetUri": "",
"clientFirstName": "*",
"clientLastName": "*",
"clientUsername": "",
"clientEmail": "*",
"productName": "",
"appId": "*",
"appName": "",
"appStatus": "approved",
"appExpiresAt": "",
"headers": {
"Accept": " ****",
"Accept-Encoding": " ****",
"Access-Control-Allow-Credentials": " ****",
"Access-Control-Allow-Headers": " ****",
"Access-Control-Allow-Methods": " ****",
"Access-Control-Allow-Origin": " ****",
"Access-Control-Max-Age": " ****",
"Authorization": " ****",
"Content-Length": " ****",
"Content-Type": " ****",
"Host": " ****",
"Postman-Token": " ****",
"User-Agent": " ****",
"X-Content-Type-Options": " ****",
"X-Forwarded-For": " ****",
"X-Forwarded-Port": " ****",
"X-Forwarded-Proto": " ****",
"X-XSS-Protection": " ****"
},
"hashedHeaders": "*",
"queryParams": "",
"payload": {
"post.statusId": " ****",
"post.body": " ****",
"post.mediaId": " ****",
"post.actions.0.id": " ****",
"post.actions.0.order": " ****",
"post.actions.0.label": " ****",
"post.actions.0.params.0.key": " ****",
"post.actions.0.params.0.value": " ****",
"post.actions.0.value": " ****"
},
"hashedPayload": "*",
"organizationName": "*",
"clientReceivedStartTime": "*",
"clientReceivedEndTime": "*",
"duration": 5,
"status": ""
}
}
]
```
Here is my config file:
```auto
input {
beats {
port => 5044
}
}
filter {
json {
source => "message"
target => "logs"
}
split {
field => "logs"
}
}
output {
elasticsearch {
hosts => [localhost:9200"]
user => '*'
password => '*'
index => "logsatsh_test-%{+YYYY.MM.dd}"
}
}
```
In Kibana i got the logs mapped almost correctly but it's still being logged as single event with the error that reads:
```auto
Error decoding JSON: json: cannot unmarshal array into Go value of type map[string]interface {}
```
Note: I'm using Logstash with Filebeat.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 11, 2023, 4:07pm UTC](https://discuss.elastic.co/t/splitting-an-array-of-objects-using-logstash/349066/2 "2023-12-11T16:07:09Z")
> [@M0hsen](#):
>
> `cannot unmarshal array into Go value of type map[string]interface {}`
That is a Go error, which means it comes from filebeat, not logstash. You must be trying to parse the JSON in filebeat, so this is a filebeat question, not a logstash question.
---
### Author:  [@M0hsen](https://discuss.elastic.co/u/M0hsen)
#### Post date: [December 11, 2023, 4:21pm UTC](https://discuss.elastic.co/t/splitting-an-array-of-objects-using-logstash/349066/3 "2023-12-11T16:21:38Z")
yes, but i also commented out output.elasticsearch in the filebeat yaml. Any idea on why is it showing that error message?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 8, 2024, 4:22pm UTC](https://discuss.elastic.co/t/splitting-an-array-of-objects-using-logstash/349066/4 "2024-01-08T16:22:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.