IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

› › ›

JSON processor

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

JSON processor

edit

Converts a JSON string into a structured JSON object.

Table 28. Json Options

Name	Required	Default	Description
`field`	yes	-	The field to be parsed.
`target_field`	no	`field`	The field that the converted structured object will be written into. Any existing content in this field will be overwritten.
`add_to_root`	no	false	Flag that forces the parsed JSON to be added at the top level of the document. `target_field` must not be set when this option is chosen.
`add_to_root_conflict_strategy`	no	`replace`	When set to `replace`, root fields that conflict with fields from the parsed JSON will be overridden. When set to `merge`, conflicting fields will be merged. Only applicable if `add_to_root` is set to `true`.
`allow_duplicate_keys`	no	false	When set to `true`, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins.
`description`	no	-	Description of the processor. Useful for describing the purpose of the processor or its configuration.
`if`	no	-	Conditionally execute the processor. See Conditionally run a processor.
`ignore_failure`	no	`false`	Ignore failures for the processor. See Handling pipeline failures.
`on_failure`	no	-	Handle failures for the processor. See Handling pipeline failures.
`tag`	no	-	Identifier for the processor. Useful for debugging and metrics.

All JSON-supported types will be parsed (null, boolean, number, array, object, string).

Suppose you provide this configuration of the json processor:

{
  "json" : {
    "field" : "string_source",
    "target_field" : "json_target"
  }
}

If the following document is processed:

{
  "string_source": "{\"foo\": 2000}"
}

after the json processor operates on it, it will look like:

{
  "string_source": "{\"foo\": 2000}",
  "json_target": {
    "foo": 2000
  }
}

If the following configuration is provided, omitting the optional target_field setting:

{
  "json" : {
    "field" : "source_and_target"
  }
}

then after the json processor operates on this document:

{
  "source_and_target": "{\"foo\": 2000}"
}

it will look like:

{
  "source_and_target": {
    "foo": 2000
  }
}

This illustrates that, unless it is explicitly named in the processor configuration, the target_field is the same field provided in the required field configuration.

« Join processor KV processor »