# Trouble Ingesting JSON

**URL:** <https://discuss.elastic.co/t/trouble-ingesting-json/190315>\
**Category:** Logstash\
**Created:** [July 12, 2019, 10:11pm UTC](https://discuss.elastic.co/t/trouble-ingesting-json/190315 "2019-07-12T22:11:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [July 12, 2019, 10:11pm UTC](https://discuss.elastic.co/t/trouble-ingesting-json/190315/1 "2019-07-12T22:11:18Z")

</div>

I am trying to ingest a JSON document. Unfortunately, there seems to be a problem with null values on an object field. There are multiple fields like this, how can I resolve it?

When the field is null, it looks like this:

```auto
	"assigned_to": "",

```

However, when there is content, the field looks like this:

```auto
	"assigned_to": {
		"link": "https://ba",
		"value": "ba"
	},

```

I get an error in logstashing stating:

```auto
"failed to parse field [assigned_to] of type [text] in document with id '59k36GsBxmyDjcqePz6P'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:2174"}}}}}

```

Pipeline

```auto
input {
  file {
    id => "Ingest"
    path => "/*.json"
    stat_interval => 2
    start_position => "beginning"
    close_older => 300
  }
}
filter {
  json {
    id => "Parse"
    source => "message"
  }
}
output {
  elasticsearch {
    id => "Send to Elasticsearch"
  }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 12, 2019, 11:59pm UTC](https://discuss.elastic.co/t/trouble-ingesting-json/190315/2 "2019-07-12T23:59:36Z")

</div>

That's expected. In elasticsearch can be an object, or text (or date etc.), but it cannot be text on some documents and an object on others.

```
    if [assigned_to] == "" {
        mutate { rename => { "[assigned_to]" => "[assigned_to][value]" } }
    }
```

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [July 13, 2019, 2:14am UTC](https://discuss.elastic.co/t/trouble-ingesting-json/190315/3 "2019-07-13T02:14:37Z")

</div>

Excellent, is there a way to apply this kind of logic to all fields? The data I am ingesting has about 100 fields and, while I am uncertain as to how many will be like this, I'd prefer to not have to create a long, monotonous pipeline for it.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 13, 2019, 1:08pm UTC](https://discuss.elastic.co/t/trouble-ingesting-json/190315/4 "2019-07-13T13:08:07Z")

</div>

> [@wwalker](#):
>
> Excellent, is there a way to apply this kind of logic to all fields?

You might be able to do it using a ruby filter and event.to\_hash.each.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 10, 2019, 1:08pm UTC](https://discuss.elastic.co/t/trouble-ingesting-json/190315/5 "2019-08-10T13:08:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.