---
title: JSON extract processor
description: Extract values from JSON strings using JSONPath-like selectors with the Streams JSON extract processor in Streamlang.
url: https://www.elastic.co/elastic/docs-builder/docs/3716/solutions/observability/streams/processors/json-extract
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Observability
  - Elastic Stack
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.4
---

# JSON extract processor
The **JSON extract** processor extracts values from a JSON-encoded string field using JSONPath-like selectors, and writes each extracted value to its own target field. Supported selector syntax includes dot notation (`user.address.city`), bracket notation (`['user']['name']`), and array indexing (`items[0]`), with an optional `$` root prefix.
To extract values from a JSON string:
1. Select **Create** → **Create processor**.
2. Select **JSON extract** from the **Processor** menu.
3. Set **Field with JSON string** to the field containing the JSON string to parse.
4. For each value you want to extract, select **Add extraction** and set:
   - **Selector**: A JSONPath-like selector for the value to extract, for example `user.id`, `$.metadata.client.ip`, or `items[0].name`.
- **Target**: The field to store the extracted value in.
- **Type**: The data type for the extracted value: `Keyword`, `Integer`, `Long`, `Double`, or `Boolean`. Defaults to `Keyword`.


## YAML reference

In [YAML mode](/elastic/docs-builder/docs/3716/solutions/observability/streams/parse-and-process#streams-editing-yaml-mode), configure the JSON extract processor using the following parameters. For the complete Streamlang syntax, refer to the [Streamlang reference](https://www.elastic.co/elastic/docs-builder/docs/3716/solutions/observability/streams/streamlang).

| Parameter                    | Type    | Required | Description                                                                                                            |
|------------------------------|---------|----------|------------------------------------------------------------------------------------------------------------------------|
| `field`                      | string  | Yes      | Source field containing the JSON string to parse.                                                                      |
| `extractions`                | array   | Yes      | List of extraction specifications. Each item requires a `selector` and `target_field`, and accepts an optional `type`. |
| `extractions[].selector`     | string  | Yes      | JSONPath-like selector to extract a value, for example `user.id`, `$.metadata.client.ip`, or `items[0].name`.          |
| `extractions[].target_field` | string  | Yes      | Target field to store the extracted value.                                                                             |
| `extractions[].type`         | string  | No       | Data type for the extracted value: `keyword`, `integer`, `long`, `double`, or `boolean`. Defaults to `keyword`.        |
| `ignore_missing`             | boolean | No       | When `true`, skip this processor if the source field is missing.                                                       |

```yaml
- action: json_extract
  field: attributes.message
  extractions:
    - selector: metadata.client.ip
      target_field: attributes.client.ip
```

Given a document with `attributes.message` set to `{"metadata": {"client": {"ip": "192.168.1.1"}}}`, the processor adds `attributes.client.ip: "192.168.1.1"`.