# Unable to parse nested JSON using logstash **URL:** \ **Category:** Logstash\ **Created:** [October 9, 2019, 7:54pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906 "2019-10-09T19:54:56Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [October 9, 2019, 7:54pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906/1 "2019-10-09T19:54:56Z")
Nested JSON response - { "application": "FinClient", "occurredOn": "2019-10-07T10:38:39", "host": "U8HPP213", "finEvents": [ { "@xmlns": "[http://jabber.org/protocol/pubsub](http://jabber.org/protocol/pubsub)", "data": { "apiErrors": { "apiError": { "errorData": "78", "errorMessage": "CF\_REQUEST\_TIMEOUT\_REJECTION", "errorType": "Device Timeout" } } }, "event": "put", "requestId": "", "source": "/finesse/api/Dialog/52031" }, "Error Handler Invoked for the msgEvent with reason code:78" ], "userName": "T01232D" } Logstash Configuration - json { source =\> "message" } Issue - I am getting a nested JSON response and inside an array. The array can either have single line statements or can have mix of JSON or statements. I would like to extract the errorData value if a JSON entry is returned, else return the statements. The logstash configuration works fine if there are only statements returned. The issue arises if JSON is present. Tried changing all the json configuration under logstash as per other forum queries, but still no luck. At the end after pulling the data, I expect it to come under Kibana as a new field for errorData (78) and the entire json as a string entry under messages. Can anyone please let me know how to achieve this ? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 9, 2019, 8:08pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906/2 "2019-10-09T20:08:20Z")
A json filter has no problem parsing that ``` "userName" => "T01232D", "application" => "FinClient", "finEvents" => [ [0] { "source" => "/finesse/api/Dialog/52031", "requestId" => "", "event" => "put", "@xmlns" => "http://jabber.org/protocol/pubsub", "data" => { "apiErrors" => { "apiError" => { "errorData" => "78", "errorType" => "Device Timeout", "errorMessage" => "CF_REQUEST_TIMEOUT_REJECTION" } } } }, [1] "Error Handler Invoked for the msgEvent with reason code:78" ], "host" => "U8HPP213", "occurredOn" => "2019-10-07T10:38:39" ``` It sounds like you want to iterate over finEvents, but what exactly do you want to do for the hashes and for the strings? ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [October 9, 2019, 10:31pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906/3 "2019-10-09T22:31:17Z")
> [@Badger](#): > > errorData Thanks for the quick reply. I also saw that the log is getting parsed successfully through logstash. But the event does'nt shows up in Kibana. I am unable to retrieve any error associated with it, if any. I am only looking for retrieving the errorData , errorType and errorMessage. Other strings can be dropped or ignored. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 9, 2019, 10:53pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906/4 "2019-10-09T22:53:16Z")
> [@Sameer\_Panicker](#): > > I am only looking for retrieving the errorData , errorType and errorMessage. Other strings can be dropped or ignored. You are still not saying what you want. Would this work? "finEvents" =\> [ [0] { "errorData" =\> "78", "errorType" =\> "Device Timeout", "errorMessage" =\> "CF\_REQUEST\_TIMEOUT\_REJECTION" }, [1] "Error Handler Invoked for the msgEvent with reason code:78" ], if not, then what do you want? ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [October 9, 2019, 11:06pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906/5 "2019-10-09T23:06:46Z")
This wont help, because in Kibana how can I see the errorData or type ? I expect an indexed field for errorType and errorData under Kibana so that I can query or create visualization out of it. I need to extract the json field (errorData) and represent it as an new field. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 9, 2019, 11:09pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906/6 "2019-10-09T23:09:23Z")
Please tell me what you want the result to look like. I am not going to keep guessing. ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [October 9, 2019, 11:13pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906/7 "2019-10-09T23:13:28Z")
Logstash Response - "userName" =\> "T01232D", "errorData" =\> "78", "errorType" =\> "Device Timeout", "errorMessage" =\> "CF\_REQUEST\_TIMEOUT\_REJECTION", "host" =\> "U8HPP213", "occurredOn" =\> "2019-10-07T10:38:39" ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [October 10, 2019, 6:37pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906/8 "2019-10-10T18:37:45Z")
@Badger - Could you please let me know if my response is not clear ? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 10, 2019, 7:31pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906/9 "2019-10-10T19:31:39Z")
You could use something like ``` ruby { code => ' finEvents = event.get("finEvents") if finEvents finEvents.each { |x| if x["data"] event.set("errorMessage", x["data"]["apiErrors"]["apiError"]["errorMessage"]) event.set("errorData", x["data"]["apiErrors"]["apiError"]["errorData"]) event.set("errorType", x["data"]["apiErrors"]["apiError"]["errorType"]) end } end ' } ``` ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [October 10, 2019, 8:09pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906/10 "2019-10-10T20:09:00Z")
Thats cool !!! Thanks Badger 🙂 I will give it a try and let you know. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 7, 2019, 8:09pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906/11 "2019-11-07T20:09:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.