# Store json object in a field in logstash

**URL:** <https://discuss.elastic.co/t/store-json-object-in-a-field-in-logstash/380748>\
**Category:** Logstash\
**Created:** [August 5, 2025, 8:20am UTC](https://discuss.elastic.co/t/store-json-object-in-a-field-in-logstash/380748 "2025-08-05T08:20:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex\_petrov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_petrov/32/105688_2.png) [@alex\_petrov](https://discuss.elastic.co/u/alex_petrov)\
**Post date:** [August 5, 2025, 8:20am UTC](https://discuss.elastic.co/t/store-json-object-in-a-field-in-logstash/380748/1 "2025-08-05T08:20:02Z")

</div>

consider this log :

```auto
{
  "timestamp": "2025-08-04T12:32:50.9698972+03:30",
    "body": {
      "instanceId": "abc123",
      "variable": "testVar",
      "testInt": 42,
      "testBool": true,
      "data": {
        "extendedInstanceId": "ext123",
        "extendedVariable": "extVar",
        "extendedTestInt": 99,
        "extendedTestBool": false
      }
    },
  "response": {
    "code": 400,
    "exceptionName": null,
    "message": null,
    "className": null,
    "methodName": null,
    "lineNumber": null,
    "body": "Error Exception 1 !! Error Exception 2 !! Error Exception 3 !!"
  }
}

```

I want to store whole response object in a field , how can I do this ?

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [August 5, 2025, 10:03am UTC](https://discuss.elastic.co/t/store-json-object-in-a-field-in-logstash/380748/2 "2025-08-05T10:03:12Z")

</div>

Hello @alex_petrov

I think you can try using below config :

```auto
filter {
  json {
    source => "message"
    target => "parsed_json"
  }

  mutate {
    add_field => {
      "[response]" => "%{[parsed_json][response]}"
    }

    rename => {
      "[timestamp]" => "timestamp"
      "[parsed_json][body][instanceId]" => "instanceId"
      "[parsed_json][body][variable]" => "variable"
      "[parsed_json][body][testInt]" => "testInt"
      "[parsed_json][body][testBool]" => "testBool"
      "[parsed_json][body][data][extendedInstanceId]" => "extendedInstanceId"
      "[parsed_json][body][data][extendedVariable]" => "extendedVariable"
      "[parsed_json][body][data][extendedTestInt]" => "extendedTestInt"
      "[parsed_json][body][data][extendedTestBool]" => "extendedTestBool"
    }

    remove_field => ["message", "parsed_json"]
  }
}

```

![image](https://us1.discourse-cdn.com/elastic/optimized/3X/2/a/2a861029b28007cb2114c3e3e52f4196ced9eac0_2_690x66.png)

Thanks!!