JSON

Parse Elastic Compatible

Synopsis

Parses JSON strings from a specified field into structured objects.

Schema

json:
  - field: <ident>
  - add_to_root: <boolean>
  - add_to_root_conflict_strategy: <enum>
  - allow_duplicate_keys: <boolean>
  - description: <text>
  - if: <script>
  - ignore_failure: <boolean>
  - ignore_missing: <boolean>
  - on_failure: <processor[]>
  - on_success: <processor[]>
  - tag: <string>
  - target_field: <ident>

Configuration

Field	Required	Default	Description
`field`	Y	-	Source field containing JSON string
`add_to_root`	N	`false`	Add parsed fields to document root
`add_to_root_conflict_strategy`	N	`replace`	Strategy for root conflicts: `replace` or `merge`
`allow_duplicate_keys`	N	`false`	Allow duplicate keys in JSON
`description`	N	-	Documentation note
`if`	N	-	Conditional expression
`ignore_failure`	N	`false`	Skip processing errors
`ignore_missing`	N	`false`	Skip if input field missing
`on_failure`	N	-	Error handling processors
`on_success`	N	-	Success handling processors
`tag`	N	-	Identifier for logging
`target_field`	N	-	Output field for parsed object

Details

The processor can either store the parsed object in a target field or merge it into the document root, with configurable strategies for handling conflicts and duplicate keys.

note

When add_to_root is set to true, target_field must not be set as fields are added directly to the document root.

The processor supports two strategies for handling conflicts when adding to root:

replace - Existing fields are overwritten with the new values
merge - Objects are merged recursively, arrays are concatenated, and primitive values are replaced

warning

Setting allow_duplicate_keys to true may lead to unpredictable results as only the last value for a key is retained.

Examples

Basic

Parsing JSON string to object...

{
  "raw_data": "{\"key\": \"value\", \"number\": 123}"
}

json:
  - field: raw_data
  - target_field: parsed_data

creates a structured object:

{
  "raw_data": "{\"key\": \"value\", \"number\": 123}",
  "parsed_data": {
    "key": "value",
    "number": 123
  }
}

Adding to Root

Merging JSON into the document root...

{
  "existing_field": "old_value",
  "json_data": "{\"new_field\": \"new_value\", \"existing_field\": \"updated_value\"}"
}

json:
  - field: json_data
  - add_to_root: true
  - add_to_root_conflict_strategy: replace

replaces the existing values:

{
  "existing_field": "updated_value",
  "json_data": "{\"new_field\": \"new_value\", \"existing_field\": \"updated_value\"}",
  "new_field": "new_value"
}

Merge

Merging nested objects...

{
  "config": {
    "timeout": 30,
    "retries": 3
  },
  "json_update": "{\"config\": {\"maxSize\": 1000, \"timeout\": 60}}"
}

json:
  - field: json_update
  - add_to_root: true
  - add_to_root_conflict_strategy: merge

combines existing and new values:

{
  "config": {
    "timeout": 60,
    "retries": 3,
    "maxSize": 1000
  },
  "json_update": "{\"config\": {\"maxSize\": 1000, \"timeout\": 60}}"
}

Duplicate Keys

Handling the duplicate keys in JSON...

{
  "data": "{\"key\": \"first\", \"key\": \"second\"}"
}

json:
  - field: data
  - allow_duplicate_keys: true
  - target_field: result

keeps the last value:

{
  "data": "{\"key\": \"first\", \"key\": \"second\"}",
  "result": {
    "key": "second"
  }
}

Error Handling

Handling invalid JSON gracefully...

{
  "data": "{invalid json}"
}

json:
  - field: data
  - ignore_failure: true
  - on_failure:
      - set:
          - field: error
          - value: "Invalid JSON format"

captures the error information:

{
  "data": "{invalid json}",
  "error": "Invalid JSON format"
}

Synopsis​

Schema​

Configuration​

Details​

Examples​

Basic​

Adding to Root​

Merge​

Duplicate Keys​

Error Handling​