# Add original message to documents logged with decode\_json\_fields
**URL:** https://discuss.elastic.co/t/add-original-message-to-documents-logged-with-decode-json-fields/76772
**Category:** Beats
**Tags:** filebeat
**Created:** [February 28, 2017, 11:56am UTC](https://discuss.elastic.co/t/add-original-message-to-documents-logged-with-decode-json-fields/76772 "2017-02-28T11:56:52Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Cylindric](https://discuss.elastic.co/u/Cylindric)
#### Post date: [February 28, 2017, 11:56am UTC](https://discuss.elastic.co/t/add-original-message-to-documents-logged-with-decode-json-fields/76772/1 "2017-02-28T11:56:52Z")
Hi folks. I am using Filebeat to log a bunch of JSON-formatted log-files into ES, and occasionally I get records with a json error such as
```
Error decoding JSON: invalid character ',' in numeric literal
```
Can I add the original message field to each document in some way, so I can see what the raw json line was that caused this error? I suspect it's just something not formatted correctly in my log file, but I can't just search for `,` 😉
```
-
type: log
document_type: varnish
close_inactive: 1m
ignore_older: 15m
paths:
- /var/log/varnish/varnishncsa.log
json.keys_under_root: true
json.add_error_key: true
json.overwrite_keys: true
```
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [March 1, 2017, 8:20am UTC](https://discuss.elastic.co/t/add-original-message-to-documents-logged-with-decode-json-fields/76772/2 "2017-03-01T08:20:33Z")
This is currently not possible but I can see that it could be useful to have in the error message as the line that could not be decoded. Could you open a feature request on Github for this?
---
### Author:  [@Cylindric](https://discuss.elastic.co/u/Cylindric)
#### Post date: [March 1, 2017, 9:57am UTC](https://discuss.elastic.co/t/add-original-message-to-documents-logged-with-decode-json-fields/76772/3 "2017-03-01T09:57:55Z")
Done, thank you for confirming so I don't chase my own tail 🙂
>
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [March 1, 2017, 3:59pm UTC](https://discuss.elastic.co/t/add-original-message-to-documents-logged-with-decode-json-fields/76772/4 "2017-03-01T15:59:47Z")
Maybe you could use the `decode_json_fields` processor. It does not delete the source field. Then you could use a `drop_fields` processor to delete the `message` field when the `json_error` key is not present. Just a thought, haven't tried it.
[https://www.elastic.co/guide/en/beats/filebeat/current/decode-json-fields.html](https://www.elastic.co/guide/en/beats/filebeat/current/decode-json-fields.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 29, 2017, 4:00pm UTC](https://discuss.elastic.co/t/add-original-message-to-documents-logged-with-decode-json-fields/76772/5 "2017-03-29T16:00:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.