PHP parsing ElasticSearch json method, with all the JSON elements

The following is the JSON information returned by Eleasticsearch:
{
"Took": 12,
"Timed_out": false,
"_shards": {
"Total": 5,
"Successful": 5,
"Failed": 0
},
"Hits": {
"Total": 8,
"Max_score": 2.6739764,
"Hits": [{
"_index": "CEF",
"_type": "Alert",
"_id": "6",
"_score": 2.6739764,
"_source": {
"User": "Dean",
"Version": "0",
"Device_vendor": "Security",
"Device_product": "Threatmanager",
"Device_version": "1.0",
"signature_id": "100",
"description": "Worm successfully stopped",
"Severity": "10",
"Extension": "src=10.0.0.1 dst=2.1.2.2 spt=1232"
}
}, {
"_index": "CEF",
"_type": "Alert",
"_id": "5",
"_score": 2.3862944,
"_source": {
"User": "Dean",
"Version": "0",
"Device_vendor": "Security",
"Device_product": "Threatmanager",
"Device_version": "1.0",
"signature_id": "100",
"description": "Worm successfully stopped",
"Severity": "10",
"Extension": "src=10.0.0.1 dst=2.1.2.2 spt=1232",
"Ext1": "src=10.0.0.1 dst=2.1.2.2 spt=1232"
}
}, {
"_index": "CEF",
"_type": "Alert",
"_id": "aupmu6m4z71lxpfodg1f",
"_score": 2.098612,
"_source": {"user": "Dean", "version": "0", "Device_vendor": "Security", "Device_product": "Threatmanager", "Device_ Version ":" 1.0 "," signature_id ":" The "," description ":" Worm successfully stopped "," severity ":" Ten "," extension ":" src= 10.0.0.1 dst=2.1.2.2 spt=1333 "," Ext4 ":" src=10.0.0.1 dst=2.1.2.2 spt=1232 "," Ext6 ":" src=10.0.0.1 dst=2.1.2.2 spt=1232 " }
}, {
"_index": "CEF",
"_type": "Alert",
"_id": "aupmxkddz71lxpfodg1g",
"_score": 2.098612,
"_source": {"user": "Dean", "version": "0", "Device_vendor": "Security", "Device_product": "Threatmanager", "Device_ Version ":" 1.0 "," signature_id ":" The "," description ":" Worm successfully stopped "," severity ":" Ten "," extension ":" src= 10.0.0.1 dst=2.1.2.2 spt=1333 "," ext2 ":" src=10.0.0.1 dst=2.1.2.2 spt=1232 "}
}, {
"_index": "CEF",
"_type": "Alert",
"_id": "4",
"_score": 2.098612,
"_source": {
"User": "Dean",
"Version": "0",
"Device_vendor": "Security",
"Device_product": "Threatmanager",
"Device_version": "1.0",
"signature_id": "100",
"description": "Worm successfully stopped",
"Severity": "10",
"Extension": "src=10.0.0.1 dst=2.1.2.2 spt=1232",
"ext62": "src=10.0.0.1 dst=2.1.2.2 spt=1232"
}
}, {
"_index": "CEF",
"_type": "Alert",
"_id": "3",
"_score": 2.098612,
"_source": {
"User": "Dean",
"Version": "0",
"Device_vendor": "Security",
"Device_product": "Threatmanager",
"Device_version": "1.0",
"signature_id": "100",
"description": "Worm successfully stopped",
"Severity": "10",
"Extension": "src=10.0.0.1 dst=2.1.2.2 spt=1232",
"Ext10": "src=10.0.0.1 dst=2.1.2.2 spt=1232"
}
}, {
"_index": "CEF",
"_type": "Alert",
"_id": "2",
"_score": 1.5108256,
"_source": {
"User": "Dean",
"Version": "0",
"Device_vendor": "Security",
"Device_product": "Threatmanager",
"Device_version": "1.0",
"signature_id": "100",
"description": "Worm successfully stopped",
"Severity": "10",
"Extension": "src=10.0.0.1 dst=2.1.2.2 spt=1232"
"Ext7": "src=10.0.0.1 dst=2.1.2.2 spt=1232"
}
}, {
"_index": "CEF",
"_type": "Alert",
"_id": "AUPMUF-PZ71LXPFODG1E",
"_score": 1.5108256,
"_source": {"user": "Dean", "version": "0", "Device_vendor": "Security", "Device_product": "Threatmanager", "Device_ Version ":" 1.0 "," signature_id ":" The "," description ":" Worm successfully stopped "," severity ":" Ten "," extension ":" src= 10.0.0.1 dst=2.1.2.2 spt=1232 "," ext19 ":" src=10.0.0.1 dst=2.1.2.2 spt=1232 "," ext41 ":" src=10.0.0.1 dst=2.1.2.2 spt= 1232 "," Ext9 ":" src=10.0.0.1 dst=2.1.2.2 spt=1232 "}
} ]
}
}

As you can see, there will be an extension ext linked fields (not just ext), sometimes three, sometimes one, or even 10, in the rear.
Now the way I parse it is
decoded = Json_decode ($json); Decode JSON
$results = $decoded->hits->hits;
foreach ($results as $item) {
$id = $item->_id; Get the ID
$version = $item->_source->version; Get the version
$user = $item->_source->user; Get the user
$device _vendor = $item->_source->devicevendor; Get the Device_vendor
$device _product = $item->_source->deviceproduct; Get the Device_product
$device _version = $item->_source->deviceversion; Get the Device_version
$signature _id = $item->_source->signatureid; Get the signature_id
$description = $item->_source->name; Get the description
$severity = $item->_source->severity; Get the severity
$extension = $item->_source->extension; Get the extension

}

This way of writing can clearly anotherjob out the information I need, if I know what the linked fields bit is.
It's like there's no way to predict the linked fields bit, only to go through the whole JSON, but I don't know how to do it, I want you to point it out first.
Thank you!

PHP parsing ElasticSearch json method, with all the JSON elements