# Data output from json by fields **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** pipeline-rules\ **Created:** [July 29, 2021, 9:59am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681 "2021-07-29T09:59:10Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![anzor](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@anzor](https://community.graylog.org/u/anzor)\ **Post date:** [July 29, 2021, 9:59am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/1 "2021-07-29T09:59:10Z")
Good afternoon! I’m new to creating scripts and I don’t quite understand, I read the documentation and I didn’t understand anything: (could you tell me how I can extract data from the field, this log comes with json result {orgName = data, cnts = [{“cnt”: value, “state”: “data”}, {“cnt”: value, “state”: “data”}], orgBinIin = value} I need to display data and values ​​in separate fields I will be grateful for any help ---
**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\ **Post date:** [July 29, 2021, 10:31am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/2 "2021-07-29T10:31:22Z")
hi @anzor , please be more verbose, what you want to archive? 1. What graylog version do you use? 2. You post you want to create script. Do you mean you want to parse json output from text file in some cli script? Or you want to parse json data in graylog using extractor or pipeline rule? 3. Which exact data and values you want to extract, it’s not obvious, there are a lot of value and data in your json example. ---
**Author:** ![anzor](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@anzor](https://community.graylog.org/u/anzor)\ **Post date:** [July 29, 2021, 3:42pm UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/3 "2021-07-29T15:42:45Z")
hi! @shoothub 1.I am using graylog 4.1 version 2.Yes, I want to parse json data in graylog using extractor or pipeline by outputting to new fields 1. I want to output (orgName = data), (“cnt”: value), (“state”: “data”) into new fields that will be named 1. Service\_name 2. Service\_value 3. Service\_status ---
**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\ **Post date:** [July 30, 2021, 10:12am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/4 "2021-07-30T10:12:26Z")
First of all, your example data is not all jsons. Only cnts is json. Json has a basic syntax for fields `"key": "value"`, so `orgName = data`, `cnts = ` and `orgBinIin = value` don’t use json syntax. Only json syntax is at `cnts = ` especially `[{"cnt": "value", "state": "data"}, {"cnt": "value", “state”: "data"}]`, which is type array. It’s not obvious how you want to extract from this array, only first index, or how? So there more solution in our case: 1. Use key value extractor or pipeline rule to parse to 3 fields: orgName, cnts, orgBinIin 2. Rename fields orgName, orgBinIin to Service\_name, Service\_status 3. Parse cnts field using as json usign json extractor or pipeline rule If message have fixed syntax you can also use GROK or regex extractror or pipeline rule. ---
**Author:** ![anzor](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@anzor](https://community.graylog.org/u/anzor)\ **Post date:** [August 2, 2021, 4:38am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/5 "2021-08-02T04:38:41Z")
I figured out, I renamed the fields and output the values, I have a task to collect all the values ​​and data from the “cnt” and “state” fields, how can this be done in grok patterns? cnt and state fields contain different data ---
**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\ **Post date:** [August 2, 2021, 7:23am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/6 "2021-08-02T07:23:57Z")
Please post real example (anonymized), so we can help exactly for your case. Did you extract json part to separate field?. Is there a fix number of cnt and state fields, or multiple? ---
**Author:** ![anzor](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@anzor](https://community.graylog.org/u/anzor)\ **Post date:** [August 2, 2021, 8:08am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/7 "2021-08-02T08:08:40Z")
**result** {orgName=Система MailKZ, cnts=[{“cnt”:15,“state”:“PAID”},{“cnt”:64,“state”:“ERROR\_PAYMENT”}], orgBinIin=111111111111} This is an example of a log that comes, I split it by fields, but it takes data only for the first values, I need it to take all the value and data from the fields in an unlimited amount the statuses and values ​​of cnt and state will be different. ![index](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/f93e156decfaa2dde6f4983e41fc4523a3b83c10.png) it is not possible to transfer to state and cnt all the values ​​and data that the log sends ---
**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\ **Post date:** [August 2, 2021, 9:01am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/8 "2021-08-02T09:01:29Z")
It’s not obvious, how you want to store multiple cnt and state values in fields. In separate fields? E.g. in field state with concatenated values or how? cnt = 15, 64 state = PAID, ERROR\_PAYMENT ---
**Author:** ![anzor](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@anzor](https://community.graylog.org/u/anzor)\ **Post date:** [August 2, 2021, 9:45am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/9 "2021-08-02T09:45:05Z")
In separate fields I will give a name for each field, I will need to display this on the grafana dashboard ---
**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\ **Post date:** [August 2, 2021, 10:06am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/10 "2021-08-02T10:06:23Z")
You mean, like this?: state1 = PAID cnt1 = 15 state2 = ERROR\_PAYMENT cnt2 = 64 ---
**Author:** ![anzor](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@anzor](https://community.graylog.org/u/anzor)\ **Post date:** [August 2, 2021, 11:19am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/11 "2021-08-02T11:19:35Z")
Yes, everything is correct, I will change the field names to the appropriate status ---
**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\ **Post date:** [August 2, 2021, 2:33pm UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/12 "2021-08-02T14:33:30Z")
Not very optimized, but it should work: `cnts=\[\{"cnt":%{NONNEGINT:cnt1},"state":%{QUOTEDSTRING:state1}\}(?:,\{"cnt":%{NONNEGINT:cnt2},"state":%{QUOTEDSTRING:state2}\})?(?:,\{"cnt":%{NONNEGINT:cnt3},"state":%{QUOTEDSTRING:state3}\})?\]` Example for 3 statuses, if need more copy more times. ---
**Author:** ![anzor](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@anzor](https://community.graylog.org/u/anzor)\ **Post date:** [August 3, 2021, 7:15am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/13 "2021-08-03T07:15:03Z")
Everything works great thanks and apologize for my stupidity ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [August 17, 2021, 7:15am UTC](https://community.graylog.org/t/data-output-from-json-by-fields/20681/14 "2021-08-17T07:15:46Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.