Skip to main content
Version: 1.1.0

JSON

Parse Elastic Compatible

Synopsis​

Parses JSON strings from a specified field into structured objects.

Schema​

json:
  - field: <ident>
  - add_to_root: <boolean>
  - add_to_root_conflict_strategy: <enum>
  - allow_duplicate_keys: <boolean>
  - description: <text>
  - if: <script>
  - ignore_failure: <boolean>
  - ignore_missing: <boolean>
  - on_failure: <processor[]>
  - on_success: <processor[]>
  - tag: <string>
  - target_field: <ident>

Configuration​

FieldRequiredDefaultDescription
fieldY-Source field containing JSON string
add_to_rootNfalseAdd parsed fields to document root
add_to_root_conflict_strategyNreplaceStrategy for root conflicts: replace or merge
allow_duplicate_keysNfalseAllow duplicate keys in JSON
descriptionN-Documentation note
ifN-Conditional expression
ignore_failureNfalseSkip processing errors
ignore_missingNfalseSkip if input field missing
on_failureN-Error handling processors
on_successN-Success handling processors
tagN-Identifier for logging
target_fieldN-Output field for parsed object

Details​

The processor can either store the parsed object in a target field or merge it into the document root, with configurable strategies for handling conflicts and duplicate keys.

note

When add_to_root is set to true, target_field must not be set as fields are added directly to the document root.

The processor supports two strategies for handling conflicts when adding to root:

  • replace - Existing fields are overwritten with the new values
  • merge - Objects are merged recursively, arrays are concatenated, and primitive values are replaced
warning

Setting allow_duplicate_keys to true may lead to unpredictable results as only the last value for a key is retained.

Examples​

Basic​

Parsing JSON string to object...

{
  "raw_data": "{\"key\": \"value\", \"number\": 123}"
}
json:
  - field: raw_data
  - target_field: parsed_data

creates a structured object:

{
  "raw_data": "{\"key\": \"value\", \"number\": 123}",
  "parsed_data": {
    "key": "value",
    "number": 123
  }
}

Adding to Root​

Merging JSON into the document root...

{
  "existing_field": "old_value",
  "json_data": "{\"new_field\": \"new_value\", \"existing_field\": \"updated_value\"}"
}
json:
  - field: json_data
  - add_to_root: true
  - add_to_root_conflict_strategy: replace

replaces the existing values:

{
  "existing_field": "updated_value",
  "json_data": "{\"new_field\": \"new_value\", \"existing_field\": \"updated_value\"}",
  "new_field": "new_value"
}

Merge​

Merging nested objects...

{
  "config": {
    "timeout": 30,
    "retries": 3
  },
  "json_update": "{\"config\": {\"maxSize\": 1000, \"timeout\": 60}}"
}
json:
  - field: json_update
  - add_to_root: true
  - add_to_root_conflict_strategy: merge

combines existing and new values:

{
  "config": {
    "timeout": 60,
    "retries": 3,
    "maxSize": 1000
  },
  "json_update": "{\"config\": {\"maxSize\": 1000, \"timeout\": 60}}"
}

Duplicate Keys​

Handling the duplicate keys in JSON...

{
  "data": "{\"key\": \"first\", \"key\": \"second\"}"
}
json:
  - field: data
  - allow_duplicate_keys: true
  - target_field: result

keeps the last value:

{
  "data": "{\"key\": \"first\", \"key\": \"second\"}",
  "result": {
    "key": "second"
  }
}

Error Handling​

Handling invalid JSON gracefully...

{
  "data": "{invalid json}"
}
json:
  - field: data
  - ignore_failure: true
  - on_failure:
      - set:
          - field: error
          - value: "Invalid JSON format"

captures the error information:

{
  "data": "{invalid json}",
  "error": "Invalid JSON format"
}