# Splitting HTTP\_Poller JSON Results

**URL:** <https://discuss.elastic.co/t/splitting-http-poller-json-results/191250>\
**Category:** Logstash\
**Created:** [July 18, 2019, 4:38pm UTC](https://discuss.elastic.co/t/splitting-http-poller-json-results/191250 "2019-07-18T16:38:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [July 18, 2019, 4:38pm UTC](https://discuss.elastic.co/t/splitting-http-poller-json-results/191250/1 "2019-07-18T16:38:58Z")

</div>

Making a call to a system for changes to tickets in a given time period, it returns the results as a single line of JSON. How can I split these out into separate events. Below is the returned results.

```auto
{ "result": [{ "u_vendor_ticket_number": "", "parent": "", "made_sla": "true", "caused_by": "", "watch_list": "", "upon_reject": "cancel", "sys_updated_on": "2019-07-18 16:03:04", "u_steps_taken": "", "u_work_request": "false", "child_incidents": "0", "hold_reason": "", "approval_history": "", "number": "pl929", "resolved_by": { "link": "https://example/api/now/table/sys_user/asrgh4b9619a7", "value": "argb9619a7" }, "sys_updated_by": "dtfjd", "opened_by": { "link": "https://example/api/now/table/sys_user/hgha4b96195d", "value": "6arggagag6195d" }, "user_input": "", "sys_created_on": "2019-07-18 15:50:30", "sys_domain": { "link": "https://example/api/now/table/sys_user_group/global", "value": "global" }, "state": "6", "sys_created_by": "argg", "knowledge": "false", "order": "", "calendar_stc": "343", "closed_at": "", "cmdb_ci": "", "impact": "3", "active": "true", "work_notes_list": "", "business_service": { "link": "https://example/api/now/table/cmdb_ci_service/aga9619e5", "value": "garge5" }, "priority": "5", "sys_domain_path": "/", "rfc": "", "time_worked": "", "expected_start": "", "opened_at": "2019-07-18 15:49:05", "business_duration": "1970-01-01 00:05:43", "group_list": "", "work_end": "", "caller_id": { "link": "https://example/api/now/table/sys_user/agawerg9619aa", "value": "8agaga43tg" }, "reopened_time": "", "resolved_at": "2019-07-18 15:54:48", "approval_set": "", "subcategory": "Security Event", "work_notes": "", "short_description": "review.", "close_code": "Request Fulfilled", "correlation_display": "", "work_start": "", "assignment_group": { "link": "https://example/api/now/table/sys_user_group/uig;guik4b961961", "value": "earsg961" }, "additional_assignee_list": "", "business_stc": "343", "description": "", "calendar_duration": "1970-01-01 00:05:43", "close_notes": "delete this email from your inbox an\r\", "notify": "1", "sys_class_name": "incident", "closed_by": "", "follow_up": "", "parent_incident": "", "sys_id": "yuklfkb961944", "contact_type": "email", "reopened_by": "", "incident_state": "6", "urgency": "5", "problem_id": "", "company": { "link": "https://example/api/now/table/core_company/a19", "value": "agag " }, "u_external_ticket": "false", "reassignment_count": "1", "u_responded": "true", "activity_due": "", "assigned_to": "", "severity": "3", "comments": "", "approval": "not requested", "sla_due": "", "u_on_site_support_scheduled_date": "", "u_reported_on_behalf_of": "", "u_webhook": "", "comments_and_work_notes": "", "due_date": "", "sys_mod_count": "5", "reopen_count": "0", "sys_tags": "", "u_alternate_contact_number": "", "escalation": "0", "upon_approval": "proceed", "u_device_tag_number": "", "u_map_url": "", "correlation_id": "", "location": "", "category": "IT" }, { "u_vendor_ticket_number": "", "parent": "", "made_sla": "true", "caused_by": "", "watch_list": "", "upon_reject": "cancel", "sys_updated_on": "2019-07-18 16:04:11", "u_steps_taken": "", "u_work_request": "false", "child_incidents": "0", "hold_reason": "", "approval_history": "", "number": "SLC0029936", "resolved_by": "", "sys_updated_by": "36e95uhy", "opened_by": { "link": "https://example/api/now/table/sys_user/rtegesg", "value": "3456tyghtd" }, "user_input": "", "sys_created_on": "2019-07-18 16:04:11", "sys_domain": { "link": "https://example/api/now/table/sys_user_group/global", "value": "global" }, "state": "1", "sys_created_by": "34tygre", "knowledge": "false", "order": "", "calendar_stc": "", "closed_at": "", "cmdb_ci": "", "impact": "2", "active": "true", "work_notes_list": "", "business_service": { "link": "https://example/api/now/table/cmdb_ci_service/324tgr", "value": "76jthyrt" }, "priority": "5", "sys_domain_path": "/", "rfc": "", "time_worked": "", "expected_start": "", "opened_at": "2019-07-18 16:03:50", "business_duration": "", "group_list": "", "work_end": "", "caller_id": { "link": "https://example/api/now/table/sys_user/4u6hrt", "value": "q34aywhgr" }, "reopened_time": "", "resolved_at": "", "approval_set": "", "subcategory": "", "work_notes": "", "short_description": "ssues", "close_code": "", "correlation_display": "", "work_start": "", "assignment_group": { "link": "https://example/api/now/table/sys_user_group/34tgebs", "value": "q3yhgesbtgd" }, "additional_assignee_list": "", "business_stc": "", "description": "", "calendar_duration": "", "close_notes": "", "notify": "1", "sys_class_name": "incident", "closed_by": "", "follow_up": "", "parent_incident": "", "sys_id": "3wqyehstbgb", "contact_type": "email", "reopened_by": "", "incident_state": "1", "urgency": "5", "problem_id": "", "company": { "link": "https://example/api/now/table/core_company/qta4gwrbszdgx", "value": "t4awgrbszxg" }, "u_external_ticket": "false", "reassignment_count": "0", "u_responded": "true", "activity_due": "", "assigned_to": "", "severity": "3", "comments": "", "approval": "not requested", "sla_due": "", "u_on_site_support_scheduled_date": "", "u_reported_on_behalf_of": "", "u_webhook": "", "comments_and_work_notes": "", "due_date": "", "sys_mod_count": "0", "reopen_count": "0", "sys_tags": "", "u_alternate_contact_number": "", "escalation": "0", "upon_approval": "proceed", "u_device_tag_number": "", "u_map_url": "", "correlation_id": "", "location": "", "category": "IT" }] }

```

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [July 18, 2019, 4:39pm UTC](https://discuss.elastic.co/t/splitting-http-poller-json-results/191250/2 "2019-07-18T16:39:23Z")

</div>

Same stuff, just pretty printed...

```auto
{
	"result": [{
		"u_vendor_ticket_number": "",
		"parent": "",
		"made_sla": "true",
		"caused_by": "",
		"watch_list": "",
		"upon_reject": "cancel",
		"sys_updated_on": "2019-07-18 16:03:04",
		"u_steps_taken": "",
		"u_work_request": "false",
		"child_incidents": "0",
		"hold_reason": "",
		"approval_history": "",
		"number": "pl929",
		"resolved_by": {
			"link": "https://example/api/now/table/sys_user/asrgh4b9619a7",
			"value": "argb9619a7"
		},
		"sys_updated_by": "dtfjd",
		"opened_by": {
			"link": "https://example/api/now/table/sys_user/hgha4b96195d",
			"value": "6arggagag6195d"
		},
		"user_input": "",
		"sys_created_on": "2019-07-18 15:50:30",
		"sys_domain": {
			"link": "https://example/api/now/table/sys_user_group/global",
			"value": "global"
		},
		"state": "6",
		"sys_created_by": "argg",
		"knowledge": "false",
		"order": "",
		"calendar_stc": "343",
		"closed_at": "",
		"cmdb_ci": "",
		"impact": "3",
		"active": "true",
		"work_notes_list": "",
		"business_service": {
			"link": "https://example/api/now/table/cmdb_ci_service/aga9619e5",
			"value": "garge5"
		},
		"priority": "5",
		"sys_domain_path": "/",
		"rfc": "",
		"time_worked": "",
		"expected_start": "",
		"opened_at": "2019-07-18 15:49:05",
		"business_duration": "1970-01-01 00:05:43",
		"group_list": "",
		"work_end": "",
		"caller_id": {
			"link": "https://example/api/now/table/sys_user/agawerg9619aa",
			"value": "8agaga43tg"
		},
		"reopened_time": "",
		"resolved_at": "2019-07-18 15:54:48",
		"approval_set": "",
		"subcategory": "Security Event",
		"work_notes": "",
		"short_description": "review.",
		"close_code": "Request Fulfilled",
		"correlation_display": "",
		"work_start": "",
		"assignment_group": {
			"link": "https://example/api/now/table/sys_user_group/uig;guik4b961961",
			"value": "earsg961"
		},
		"additional_assignee_list": "",
		"business_stc": "343",
		"description": "",
		"calendar_duration": "1970-01-01 00:05:43",
		"close_notes": "delete this email from your inbox an\r\",
		"notify": "1",
		"sys_class_name": "incident",
		"closed_by": "",
		"follow_up": "",
		"parent_incident": "",
		"sys_id": "yuklfkb961944",
		"contact_type": "email",
		"reopened_by": "",
		"incident_state": "6",
		"urgency": "5",
		"problem_id": "",
		"company": {
			"link": "https://example/api/now/table/core_company/a19",
			"value": "agag "
		},
		"u_external_ticket": "false",
		"reassignment_count": "1",
		"u_responded": "true",
		"activity_due": "",
		"assigned_to": "",
		"severity": "3",
		"comments": "",
		"approval": "not requested",
		"sla_due": "",
		"u_on_site_support_scheduled_date": "",
		"u_reported_on_behalf_of": "",
		"u_webhook": "",
		"comments_and_work_notes": "",
		"due_date": "",
		"sys_mod_count": "5",
		"reopen_count": "0",
		"sys_tags": "",
		"u_alternate_contact_number": "",
		"escalation": "0",
		"upon_approval": "proceed",
		"u_device_tag_number": "",
		"u_map_url": "",
		"correlation_id": "",
		"location": "",
		"category": "IT"
	},
	{
		"u_vendor_ticket_number": "",
		"parent": "",
		"made_sla": "true",
		"caused_by": "",
		"watch_list": "",
		"upon_reject": "cancel",
		"sys_updated_on": "2019-07-18 16:04:11",
		"u_steps_taken": "",
		"u_work_request": "false",
		"child_incidents": "0",
		"hold_reason": "",
		"approval_history": "",
		"number": "SLC0029936",
		"resolved_by": "",
		"sys_updated_by": "36e95uhy",
		"opened_by": {
			"link": "https://example/api/now/table/sys_user/rtegesg",
			"value": "3456tyghtd"
		},
		"user_input": "",
		"sys_created_on": "2019-07-18 16:04:11",
		"sys_domain": {
			"link": "https://example/api/now/table/sys_user_group/global",
			"value": "global"
		},
		"state": "1",
		"sys_created_by": "34tygre",
		"knowledge": "false",
		"order": "",
		"calendar_stc": "",
		"closed_at": "",
		"cmdb_ci": "",
		"impact": "2",
		"active": "true",
		"work_notes_list": "",
		"business_service": {
			"link": "https://example/api/now/table/cmdb_ci_service/324tgr",
			"value": "76jthyrt"
		},
		"priority": "5",
		"sys_domain_path": "/",
		"rfc": "",
		"time_worked": "",
		"expected_start": "",
		"opened_at": "2019-07-18 16:03:50",
		"business_duration": "",
		"group_list": "",
		"work_end": "",
		"caller_id": {
			"link": "https://example/api/now/table/sys_user/4u6hrt",
			"value": "q34aywhgr"
		},
		"reopened_time": "",
		"resolved_at": "",
		"approval_set": "",
		"subcategory": "",
		"work_notes": "",
		"short_description": "ssues",
		"close_code": "",
		"correlation_display": "",
		"work_start": "",
		"assignment_group": {
			"link": "https://example/api/now/table/sys_user_group/34tgebs",
			"value": "q3yhgesbtgd"
		},
		"additional_assignee_list": "",
		"business_stc": "",
		"description": "",
		"calendar_duration": "",
		"close_notes": "",
		"notify": "1",
		"sys_class_name": "incident",
		"closed_by": "",
		"follow_up": "",
		"parent_incident": "",
		"sys_id": "3wqyehstbgb",
		"contact_type": "email",
		"reopened_by": "",
		"incident_state": "1",
		"urgency": "5",
		"problem_id": "",
		"company": {
			"link": "https://example/api/now/table/core_company/qta4gwrbszdgx",
			"value": "t4awgrbszxg"
		},
		"u_external_ticket": "false",
		"reassignment_count": "0",
		"u_responded": "true",
		"activity_due": "",
		"assigned_to": "",
		"severity": "3",
		"comments": "",
		"approval": "not requested",
		"sla_due": "",
		"u_on_site_support_scheduled_date": "",
		"u_reported_on_behalf_of": "",
		"u_webhook": "",
		"comments_and_work_notes": "",
		"due_date": "",
		"sys_mod_count": "0",
		"reopen_count": "0",
		"sys_tags": "",
		"u_alternate_contact_number": "",
		"escalation": "0",
		"upon_approval": "proceed",
		"u_device_tag_number": "",
		"u_map_url": "",
		"correlation_id": "",
		"location": "",
		"category": "IT"
	}]
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 18, 2019, 4:45pm UTC](https://discuss.elastic.co/t/splitting-http-poller-json-results/191250/3 "2019-07-18T16:45:50Z")

</div>

> [@wwalker](#):
>
> ```
> "close_notes": "delete this email from your inbox an\r\",
> 
> ```

Provided you insert an n before that closing quote, so the JSON can be parsed, you can split it into two events using

```
split { field => "result" }

```

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [July 18, 2019, 6:46pm UTC](https://discuss.elastic.co/t/splitting-http-poller-json-results/191250/4 "2019-07-18T18:46:07Z")

</div>

Awesome...one last question...is it possible to have the fields not be under result? For instance, `result.opened_by` but I need it to be `opened_by`.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 18, 2019, 6:53pm UTC](https://discuss.elastic.co/t/splitting-http-poller-json-results/191250/5 "2019-07-18T18:53:39Z")

</div>

Yes, you can move all the keys to the root using code like [this](https://discuss.elastic.co/t/how-to-dynamically-move-nested-key-value-to-root-level/180006/2).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2019, 6:53pm UTC](https://discuss.elastic.co/t/splitting-http-poller-json-results/191250/6 "2019-08-15T18:53:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.