# Trying to access nested json in logstash mutate filter

**URL:** https://discuss.elastic.co/t/trying-to-access-nested-json-in-logstash-mutate-filter/35120
**Category:** Logstash
**Created:** [November 20, 2015, 6:32am UTC](https://discuss.elastic.co/t/trying-to-access-nested-json-in-logstash-mutate-filter/35120 "2015-11-20T06:32:19Z")
**Posts on this page:** 1
**Showing post:** 8

<div class="post-metadata">

### Author: ![vtst2412](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vtst2412/32/6228_2.png) [@vtst2412](https://discuss.elastic.co/u/vtst2412)
#### Post date: [November 21, 2015, 7:58pm UTC](https://discuss.elastic.co/t/trying-to-access-nested-json-in-logstash-mutate-filter/35120/8 "2015-11-21T19:58:16Z")

</div>

I'm trying to do something similar to this:

1. pipe the content of "message" to a new field "raw"
2. Add new fields by accessing the nested content inside of the original raw data
3. The fat lady sings?

Not quite. rubydebug output looks fine, but when I switch over to ES output, the fields do not resolve as expected.

> [@New fields resolve as expected in stdout output but not in elasticsearch output](https://discuss.elastic.co/t/new-fields-resolve-as-expected-in-stdout-output-but-not-in-elasticsearch-output/35206):
>
> input { file { type =\> "json" path =\> "/home/user/json/test.json" #codec =\> json start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { json { source =\> "message" target =\> "raw" add\_field =\> { "Name" =\> "%{[raw][0][content][0][data][Name]}" "Issues" =\> "%{[raw][0][content][0][data][Issues]}" "Serial" =\> "%{[raw][0][content][0][data][Serial]}" "Model" =\> "%{[raw][0][content][0][data][Model]}" "…

Did you encounter this problem?

---

_[View the full topic](https://discuss.elastic.co/t/trying-to-access-nested-json-in-logstash-mutate-filter/35120)._