cat tmp.results| ~/bin/jq '.hits.hits[]._source | select(.address) |.address' "192.168.1.1" cat tmp.results| ~/bin/jq '.hits.hits[]._source | select(.address) |{address,name}' { "name": "some name", "address": "192.168.1.1" }