# Trying to convert JSON to new JSON outputs quoted JSON

**URL:** <https://discuss.elastic.co/t/trying-to-convert-json-to-new-json-outputs-quoted-json/300998>\
**Category:** Logstash\
**Created:** [March 29, 2022, 5:35pm UTC](https://discuss.elastic.co/t/trying-to-convert-json-to-new-json-outputs-quoted-json/300998 "2022-03-29T17:35:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![geena.rollins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geena.rollins/32/15661_2.png) [@geena.rollins](https://discuss.elastic.co/u/geena.rollins)\
**Post date:** [March 29, 2022, 5:35pm UTC](https://discuss.elastic.co/t/trying-to-convert-json-to-new-json-outputs-quoted-json/300998/1 "2022-03-29T17:35:08Z")

</div>

On my macbook monterey 12.2.1, I get quoted JSON. I'm hoping for plain JSON.

logstash.yml is  
`node.name: tester`

file.conf is

```auto
input {
    file {
    	 path => ["/Users/geena.rollins/ws/hello.json"]
	 start_position => "beginning"
	 sincedb_path => "/dev/null"
	 codec => "json"
	 type => "json"
    }
}
filter {
    mutate {
        add_field => { "z" => "Yes" }
    }
}
output {
  stdout { codec => rubydebug }
  file {
    	 path => "/Users/geena.rollins/ws/result-0.json"
	 codec => "json_lines"
  }
}

```

hello.json is:  
`{ "x": "Hello, world!!!", "y": 7 }`

I'm hoping to get this output:  
`{ "x": "Hello, world!!!", "y": 7, "z": "Yes" }`

But I get this:

```auto
{"z":"Yes","y":7,"log":{"file":{"path":"/Users/geena.rollins/ws/hello.json"}},"host":{"name":"basin"},"type":"json","@version":"1","event":{"original":"{ \"x\": \"Hello, world!!!\", \"y\": 7 }"},"@timestamp":"2022-03-29T04:26:50.051510Z","x":"Hello, world!!!"}

```

```auto
{
             "z" => "Yes",
             "y" => 7,
           "log" => {
        "file" => {
            "path" => "/Users/geena.rollins/ws/hello.json"
        }
    },
          "host" => {
        "name" => "basin"
    },
          "type" => "json",
      "@version" => "1",
         "event" => {
        "original" => "{ \"x\": \"Hello, world!!!\", \"y\": 7 }"
    },
    "@timestamp" => 2022-03-29T04:26:50.051510Z,
             "x" => "Hello, world!!!"
}

```

Thank you for your advice.

```auto

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 29, 2022, 6:00pm UTC](https://discuss.elastic.co/t/trying-to-convert-json-to-new-json-outputs-quoted-json/300998/2 "2022-03-29T18:00:29Z")

</div>

> [@geena.rollins](#):
>
> { "x": "Hello, world!!!", "y": 7, "z": "Yes" }

You are getting that! If you do not want all the other fields then use a prune filter with the [whitelist\_names](https://www.elastic.co/guide/en/logstash/current/plugins-filters-prune.html#plugins-filters-prune-whitelist_names) option.

The quoted JSON in [event][original] is the new ECS way of preserving the original [message] field before it goes through any filters. If it is just that you do not want then

```
mutate { remove_field => ["[event]" ] }

```

---

<div class="post-metadata">

**Author:** ![geena.rollins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geena.rollins/32/15661_2.png) [@geena.rollins](https://discuss.elastic.co/u/geena.rollins)\
**Post date:** [March 29, 2022, 6:12pm UTC](https://discuss.elastic.co/t/trying-to-convert-json-to-new-json-outputs-quoted-json/300998/3 "2022-03-29T18:12:20Z")

</div>

Thanks Mr. B!

```auto
input {
    file {
    	 path => ["/Users/geena.rollins/ws/hello.json"]
	 start_position => "beginning"
	 sincedb_path => "/dev/null"
	 codec => "json"
	 type => "json"
    }
}
filter {
    mutate {
        add_field => { "z" => "Yes" }
	remove_field => ["[event]", "[log]" ]
    }
}
output {
  stdout { codec => rubydebug }
  file {
    	 path => "/Users/geena.rollins/ws/result-0.json"
	 codec => "json_lines"
  }
}

{"y":7,"type":"json","@version":"1","x":"Hello, world!!!","host":{"name":"basin"},"z":"Yes","@timestamp":"2022-03-29T18:09:15.098892Z"}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2022, 6:12pm UTC](https://discuss.elastic.co/t/trying-to-convert-json-to-new-json-outputs-quoted-json/300998/4 "2022-04-26T18:12:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.