JSON

Parse Elastic Compatible

Synopsis

Parses JSON strings from a specified field into structured objects.

Schema

- json:
    field: <ident>
    add_to_root: <boolean>
    add_to_root_conflict_strategy: <enum>
    allow_duplicate_keys: <boolean>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>
    target_field: <ident>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Source field containing JSON string
add_to_root	N	false	Add parsed fields to document root
add_to_root_conflict_strategy	Y*	-	Strategy for a root key collision: replace or merge. There is no default — with add_to_root set, an actual collision under an unset strategy fails with unsupported conflict strategy
allow_duplicate_keys	N	false	Accepted but not applied. The value is never read; the decoder keeps the last value for a repeated key regardless
description	N	-	Documentation note
if	N	-	Conditional expression
ignore_failure	N	false	Skip processing errors
ignore_missing	N	false	Skip if input field missing
on_failure	N	-	Error handling processors
on_success	N	-	Success handling processors
tag	N	-	Identifier for logging
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration

* = Required only when add_to_root is set AND a key actually collides. Without a collision the strategy is never consulted. |target_field|N|-|Output field for parsed object|

Details

The processor can either store the parsed object in a target field or merge it into the document root, with configurable strategies for handling conflicts and duplicate keys.

note

When add_to_root is set to true, target_field must not be set as fields are added directly to the document root.

The processor supports two strategies for handling conflicts when adding to root:

• replace - Existing fields are overwritten with the new values
• merge - Objects are merged recursively, arrays are concatenated, and primitive values are replaced

warning

The decoder always keeps the last value for a repeated key. allow_duplicate_keys does not change that — it is read nowhere in the processor.

Examples

Basic

Parsing JSON string to object...	{ "raw_data": "{\"key\": \"value\", \"number\": 123}" } - json: field: raw_data target_field: parsed_data
creates a structured object:	{ "raw_data": "{\"key\": \"value\", \"number\": 123}", "parsed_data": { "key": "value", "number": 123 } }

Adding to Root

Merging JSON into the document root...	{ "existing_field": "old_value", "json_data": "{\"new_field\": \"new_value\", \"existing_field\": \"updated_value\"}" } - json: field: json_data add_to_root: true add_to_root_conflict_strategy: replace
replaces the existing values:	{ "existing_field": "updated_value", "json_data": "{\"new_field\": \"new_value\", \"existing_field\": \"updated_value\"}", "new_field": "new_value" }

Merge

Merging nested objects...	{ "config": { "timeout": 30, "retries": 3 }, "json_update": "{\"config\": {\"maxSize\": 1000, \"timeout\": 60}}" } - json: field: json_update add_to_root: true add_to_root_conflict_strategy: merge
combines existing and new values:	{ "config": { "timeout": 60, "retries": 3, "maxSize": 1000 }, "json_update": "{\"config\": {\"maxSize\": 1000, \"timeout\": 60}}" }

Duplicate Keys

Handling the duplicate keys in JSON...	{ "data": "{\"key\": \"first\", \"key\": \"second\"}" } - json: field: data allow_duplicate_keys: true target_field: result
keeps the last value:	{ "data": "{\"key\": \"first\", \"key\": \"second\"}", "result": { "key": "second" } }

Error Handling

Handling invalid JSON gracefully...	{ "data": "{invalid json}" } - json: field: data on_failure: - set: field: error value: "Invalid JSON format"
captures the error information:	{ "data": "{invalid json}", "error": "Invalid JSON format" }