title: Access nested JSON Field in Logstash
body: <p>I have a Problem with accessing a nested JSON field in logstash (latest version).</p>
  
  <p>My config file is the following:</p>
  
  <pre><code>input {
    http {
      port =&gt; 5001
      codec =&gt; "json"
    }
  }
  
  filter {
    mutate {
      add_field =&gt; {"es_index" =&gt; "%{[statements][authority][name]}"}
    }
    mutate {
      gsub =&gt; [
        "es_index", " ", "_"
      ]
    }
    mutate {
      lowercase =&gt; ["es_index"]
    }
    ruby {
      init =&gt; "
          def remove_dots hash
              new = Hash.new
              hash.each { |k,v|
                  if v.is_a? Hash
                      v = remove_dots(v)
                  end
                  new[ k.gsub('.','_') ] = v
                  if v.is_a? Array
                      v.each { |elem|
                          if elem.is_a? Hash
                              elem = remove_dots(elem)
                          end
                          new[ k.gsub('.','_') ] = elem
                      } unless v.nil?
                  end
              } unless hash.nil?
              return new
          end
      "
      code =&gt; "
          event.instance_variable_set(:@data,remove_dots(event.to_hash))
      "
    }
  }
  
  output {
    stdout {
      codec =&gt; rubydebug
    }
    elasticsearch {
      hosts =&gt; "elasticsearch:9200"
      index =&gt; "golab-%{+YYYY.MM.dd}"
    }  
  }
  </code></pre>
  
  <p>I have a filter with mutate. I want to add a field that I can use as a part of the index name. When I use this <code>"%{[statements][authority][name]}"</code> the content in the brackets is used as string.<code>%{[statements][authority][name]}</code> is saved in the <code>es_index</code>field. Logstash seems to think this is a string, but why?</p>
  
  <p>I've also tried to use this expression: <code>"%{statements}"</code>. It's working like expected. Everything in the field statements is passed to <code>es_index</code>. If I use <code>"%{[statements][authority]}"</code> strange things happen. <code>es_index</code> is filled with the exact same output that <code>"%{statements}"</code> produces. What am I missing?</p>
  
  <p>Logstash Output with <code>"%{[statements][authority]}"</code>:</p>
  
  <pre><code>{
      "statements" =&gt; {
               "verb" =&gt; {
                   "id" =&gt; "http://adlnet.gov/expapi/verbs/answered",
              "display" =&gt; {
                  "en-US" =&gt; "answered"
              }
          },
            "version" =&gt; "1.0.1",
          "timestamp" =&gt; "2016-07-21T07:41:18.013880+00:00",
             "object" =&gt; {
              "definition" =&gt; {
                         "name" =&gt; {
                      "en-US" =&gt; "Example Activity"
                  },
                  "description" =&gt; {
                      "en-US" =&gt; "Example activity description"
                  }
              },
                      "id" =&gt; "http://adlnet.gov/expapi/activities/example"
          },
              "actor" =&gt; {
                 "account" =&gt; {
                  "homePage" =&gt; "http://example.com",
                      "name" =&gt; "xapiguy"
              },
              "objectType" =&gt; "Agent"
          },
             "stored" =&gt; "2016-07-21T07:41:18.013880+00:00",
          "authority" =&gt; {
                    "mbox" =&gt; "mailto:info@golab.eu",
                    "name" =&gt; "GoLab",
              "objectType" =&gt; "Agent"
          },
                 "id" =&gt; "0771b9bc-b1b8-4cb7-898e-93e8e5a9c550"
      },
              "id" =&gt; "a7e31874-780e-438a-874c-964373d219af",
        "@version" =&gt; "1",
      "@timestamp" =&gt; "2016-07-21T07:41:19.061Z",
            "host" =&gt; "172.23.0.3",
         "headers" =&gt; {
                "request_method" =&gt; "POST",
                  "request_path" =&gt; "/",
                   "request_uri" =&gt; "/",
                  "http_version" =&gt; "HTTP/1.1",
                     "http_host" =&gt; "logstasher:5001",
                "content_length" =&gt; "709",
          "http_accept_encoding" =&gt; "gzip, deflate",
                   "http_accept" =&gt; "*/*",
               "http_user_agent" =&gt; "python-requests/2.9.1",
               "http_connection" =&gt; "close",
                  "content_type" =&gt; "application/json"
      },
        "es_index" =&gt; "{\"verb\":{\"id\":\"http://adlnet.gov/expapi/verbs/answered\",\"display\":{\"en-us\":\"answered\"}},\"version\":\"1.0.1\",\"timestamp\":\"2016-07-21t07:41:18.013880+00:00\",\"object\":{\"definition\":{\"name\":{\"en-us\":\"example_activity\"},\"description\":{\"en-us\":\"example_activity_description\"}},\"id\":\"http://adlnet.gov/expapi/activities/example\",\"objecttype\":\"activity\"},\"actor\":{\"account\":{\"homepage\":\"http://example.com\",\"name\":\"xapiguy\"},\"objecttype\":\"agent\"},\"stored\":\"2016-07-21t07:41:18.013880+00:00\",\"authority\":{\"mbox\":\"mailto:info@golab.eu\",\"name\":\"golab\",\"objecttype\":\"agent\"},\"id\":\"0771b9bc-b1b8-4cb7-898e-93e8e5a9c550\"}"
  }
  </code></pre>
  
  <p>You can see that authority is part of <code>es_index</code>. So it was not chosen as a field.</p>
  
  <p>Many thanks in advance</p>