# Use JSON structure from input in HTTP request

**URL:** <https://discuss.elastic.co/t/use-json-structure-from-input-in-http-request/203044>\
**Category:** Logstash\
**Created:** [October 10, 2019, 2:12pm UTC](https://discuss.elastic.co/t/use-json-structure-from-input-in-http-request/203044 "2019-10-10T14:12:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MMH](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mmh/32/54449_2.png) [@MMH](https://discuss.elastic.co/u/MMH)\
**Post date:** [October 10, 2019, 2:12pm UTC](https://discuss.elastic.co/t/use-json-structure-from-input-in-http-request/203044/1 "2019-10-10T14:12:36Z")

</div>

I am trying to use JSON struct from input inside the HTTP filter request.  
The part in my input looks like this:

> {"elemId":"1","user":[{"uid" : 1,"first": "John","last": "Smith"},{"uid" : 2,"first": "Bob","last": "Jones"},{"uid" : 4,"first": "Anna","last": "Right"}]}

Inside Logstash script, I tried to feed it as following:

```auto
filter {
  http { 
    (...)
    body => '{"script": { (...), "params": {"par1": [%{[user]}]}}'
  }
}

```

which results in following in HTTP request body:

> {"script": { (...) "params": {"par1": [{last=Smith, uid=1, first=John},{last=Jones, uid=2, first=Bob},{last=Right, uid=4, first=Anna}]}}

Of course, it is not proper JSON, as field names and literals are not quoted and produce the following error:

> "error":{"root\_cause":[{"type":"mapper\_parsing\_exception","reason":"failed to parse"}],"type":"mapper\_parsing\_exception","reason":"failed to parse","caused\_by":{"type":"json\_parse\_exception","reason":"Unexpected character ('l' (code 108)): was expecting double-quote to start field name

This unexpected `l` is the first letter of `last=Smith` from the HTTP request.  
How to get this JSON from input into the string literal, but with a quotation symbols? I do not know which exact fields and how many objects will be in the input file, so I cannot hardcode it.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 10, 2019, 4:23pm UTC](https://discuss.elastic.co/t/use-json-structure-from-input-in-http-request/203044/2 "2019-10-10T16:23:28Z")

</div>

If you are starting off with a field on the event that looks like this

```
      "user" => [
    [0] {
          "uid" => 1,
         "last" => "Smith",
        "first" => "John"
    },
    [1] {
          "uid" => 2,
         "last" => "Jones",
        "first" => "Bob"
    },
    [2] {
          "uid" => 4,
         "last" => "Right",
        "first" => "Anna"
    }
],

```

then you can install the json\_encode plugin and use

```
json_encode { source => "user" target => "[@metadata][encodedUser]" }

```

to convert it into

```
    "encodedUser" => "[{\"first\":\"John\",\"last\":\"Smith\",\"uid\":1},{\"first\":\"Bob\",\"last\":\"Jones\",\"uid\":2},{\"first\":\"Anna\",\"last\":\"Right\",\"uid\":4}]",

```

and then mutate that

```
mutate { gsub => ["[@metadata][encodedUser]", '"', '\"' ] }

```

to escape the quotes and get you to

```
    "encodedUser" => "[{\\\"first\\\":\\\"John\\\",\\\"last\\\":\\\"Smith\\\",\\\"uid\\\":1},{\\\"first\\\":\\\"Bob\\\",\\\"last\\\":\\\"Jones\\\",\\\"uid\\\":2},{\\\"first\\\":\\\"Anna\\\",\\\"last\\\":\\\"Right\\\",\\\"uid\\\":4}]",

```

which I think is what you want to insert into your request body.

---

<div class="post-metadata">

**Author:** ![MMH](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mmh/32/54449_2.png) [@MMH](https://discuss.elastic.co/u/MMH)\
**Post date:** [October 11, 2019, 9:01am UTC](https://discuss.elastic.co/t/use-json-structure-from-input-in-http-request/203044/3 "2019-10-11T09:01:41Z")

</div>

> [@Badger](#):
>
> json\_encode { source =\> "user" target =\> "[@metadata][encodedUser]" }

Thank you. `json_encode` filter was the functionality I was looking for.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2019, 9:01am UTC](https://discuss.elastic.co/t/use-json-structure-from-input-in-http-request/203044/4 "2019-11-08T09:01:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.