# Use multiline and grok for splitting complex json input

**URL:** <https://discuss.elastic.co/t/use-multiline-and-grok-for-splitting-complex-json-input/111987>\
**Category:** Logstash\
**Created:** [December 15, 2017, 1:11pm UTC](https://discuss.elastic.co/t/use-multiline-and-grok-for-splitting-complex-json-input/111987 "2017-12-15T13:11:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gassogba](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@gassogba](https://discuss.elastic.co/u/gassogba)\
**Post date:** [December 15, 2017, 1:11pm UTC](https://discuss.elastic.co/t/use-multiline-and-grok-for-splitting-complex-json-input/111987/1 "2017-12-15T13:11:13Z")

</div>

Hi,

Here is the structure of my json input:

{  
"searchMeta": {  
"interval": "S10",  
"sourceIds": [  
"test1"  
],  
"startTimestamp": 1505558633,  
"endTimestamp": 1513334633,  
"startIndex": 0,  
"maxResult": 500,  
"prevResults": "",  
"nextResults": "https:XXX",  
"filter": ""  
},  
"presence": [  
{  
"timestamp": 1512086420,  
"sourceId": "test1",  
"test": "UNKNOWN",  
"deviceAddress": "AAAAAA"  
},  
{  
"timestamp": 1512086421,  
"sourceId": "test1",  
"test": "UNKNOWN",  
"deviceAddress": "BBBBB"  
}  
]  
}

I just want to store the data in the presence field.  
I found that I can use the filter split for handling the array. Yet, I don't manage to use the multiline with a json input for getting what I want. Any clue on how to deal with this kind of json format?

Here the output I would like to obtain in ES:  
{  
"@timestamp" =\> timestamp,  
"@version" =\> "1",  
"timestamp": 1512086421,  
"sourceId": "test1",  
"deviceAddress": "BBBBB"  
}

---

<div class="post-metadata">

**Author:** ![gassogba](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@gassogba](https://discuss.elastic.co/u/gassogba)\
**Post date:** [December 15, 2017, 1:59pm UTC](https://discuss.elastic.co/t/use-multiline-and-grok-for-splitting-complex-json-input/111987/2 "2017-12-15T13:59:35Z")

</div>

Well, by using the split I obtain an output with this format:

{  
"@version" =\> "1",  
"host" =\> "Some\_host",  
"path" =\> "some\_path",  
"@timestamp" =\> timestamp,  
"type" =\> "json",  
"presence" =\> {  
"timestamp": 1512086421,  
"sourceId": "test1",  
"test": "UNKNOWN",  
"deviceAddress": "BBBBB"  
}  
}

How can I transform it to obtain something like:

{  
"@version" =\> "1",  
"host" =\> "Some\_host",  
"path" =\> "some\_path",  
"@timestamp" =\> timestamp,  
"type" =\> "json",  
"timestamp": 1512086421,  
"sourceId": "test1",  
"test": "UNKNOWN",  
"deviceAddress": "BBBBB"  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 12, 2018, 1:59pm UTC](https://discuss.elastic.co/t/use-multiline-and-grok-for-splitting-complex-json-input/111987/3 "2018-01-12T13:59:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.