# Trouble splitting out json array into component elements

**URL:** <https://discuss.elastic.co/t/trouble-splitting-out-json-array-into-component-elements/218647>\
**Category:** Logstash\
**Created:** [February 10, 2020, 5:14pm UTC](https://discuss.elastic.co/t/trouble-splitting-out-json-array-into-component-elements/218647 "2020-02-10T17:14:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jeff\_Morton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeff_morton/32/62380_2.png) [@Jeff\_Morton](https://discuss.elastic.co/u/Jeff_Morton)\
**Post date:** [February 10, 2020, 5:14pm UTC](https://discuss.elastic.co/t/trouble-splitting-out-json-array-into-component-elements/218647/1 "2020-02-10T17:14:39Z")

</div>

What would be the correct approach to break a field representing a json array into new data fields representing the various component elements?

For instance I have a field that contains the following data.

[{"id": "8b55e1b8-5c8a-40ac-81d9-ce0e0e46a044","type":"team"},{"id":"4e0f58af-6f41-4449-gf7e-a38a41684e1c","type":"user"}]

I want this broken out into new nested fields like so.

data.0.id  
data.0.type  
data.1.id  
data.1.type

Regards

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 10, 2020, 7:20pm UTC](https://discuss.elastic.co/t/trouble-splitting-out-json-array-into-component-elements/218647/2 "2020-02-10T19:20:44Z")

</div>

Something like this (I haven't tested it)

```
json { source => "A field" target => "[@metadata][jsondata]" }
ruby {
    code => '
        a = event.get("[@metadata][jsondata]")
        if a
            a.each_index { |x|
                event.set("data.#{x}.type", a[x]["type"])
                event.set("data.#{x}.id", a[x]["id"]
            }
        end
    '
}
```

---

<div class="post-metadata">

**Author:** ![Jeff\_Morton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeff_morton/32/62380_2.png) [@Jeff\_Morton](https://discuss.elastic.co/u/Jeff_Morton)\
**Post date:** [February 10, 2020, 9:08pm UTC](https://discuss.elastic.co/t/trouble-splitting-out-json-array-into-component-elements/218647/3 "2020-02-10T21:08:36Z")

</div>

After some minor modifications I was able to get this working as expected.

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2020, 9:09pm UTC](https://discuss.elastic.co/t/trouble-splitting-out-json-array-into-component-elements/218647/4 "2020-03-09T21:09:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.