# All fields in are being output in the \`message\` property as a JSON string

**URL:** <https://discuss.elastic.co/t/all-fields-in-are-being-output-in-the-message-property-as-a-json-string/139543>\
**Category:** Kibana\
**Created:** [July 11, 2018, 10:41am UTC](https://discuss.elastic.co/t/all-fields-in-are-being-output-in-the-message-property-as-a-json-string/139543 "2018-07-11T10:41:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrpmorris](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrpmorris/32/33059_2.png) [@mrpmorris](https://discuss.elastic.co/u/mrpmorris)\
**Post date:** [July 11, 2018, 10:41am UTC](https://discuss.elastic.co/t/all-fields-in-are-being-output-in-the-message-property-as-a-json-string/139543/1 "2018-07-11T10:41:42Z")

</div>

I'm using NLog with a Redis target. In an older version all of the attributes in my layout used to appear as 1st class data-items when viewing in Kibana.

Since upgrading to the latest version they all appear as a JSON encoded string value against a single data-item named message.

I've tried specifying a JsonLayout for the message value but it has made no difference:

How do I get these back to first class data-items in Kibana so that I can click the Filter button against them? I don't know if this is something I need to address in Kibana, or NLog. Can anyone help?

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [July 12, 2018, 4:03am UTC](https://discuss.elastic.co/t/all-fields-in-are-being-output-in-the-message-property-as-a-json-string/139543/2 "2018-07-12T04:03:09Z")

</div>

It sounds like the data is being indexed as a JSON encoded string within Elasticsearch. Within Discover in Kibana, can you expand a record and provide the content of the JSON tab?

---

<div class="post-metadata">

**Author:** ![mrpmorris](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrpmorris/32/33059_2.png) [@mrpmorris](https://discuss.elastic.co/u/mrpmorris)\
**Post date:** [July 12, 2018, 8:52am UTC](https://discuss.elastic.co/t/all-fields-in-are-being-output-in-the-message-property-as-a-json-string/139543/3 "2018-07-12T08:52:06Z")

</div>

Thanks for your reply! The top hit in the search was as follows. The info in the `message` is what used to appear as top-level entries in Kibana.

```
"hits": [
  {
	"_index": "company-logstash-2018.04.13",
	"_type": "redis-input",
	"_id": "AWK_BxCit7NclctjJUWU",
	"_score": 12.9958105,
	"_source": {
	  "@timestamp": "2018-04-13T12:42:13.453Z",
	  "app_Name": "company-myapp.web.mysite",
	  "Version": "4.1.0.132",
	  "level": "Info",
	  "LoggerType": "Company.myapp.Web.mysite.Controllers.HomeController",
	  "@version": "1",
	  "Environment": "DEMO",
	  "message": "{ \"user\": \"<none>\", \"session\": \"OMITTED\", \"message\": \"GET \\/\", \"ticks\": \"636592201334539791\", \"processid\": \"4912\", \"userlanguages\": \"zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\", \"currentculture\": \"en-US\", \"currentuiculture\": \"en-US\", \"headers\": \"GET \\/\\nRemote Address: OMITTED\\n\\nAccept: application\\/json, text\\/plain, *\\/*\\nAccept-Charset: GBK,utf-8;q=0.7,*;q=0.3\\nAccept-Encoding: gzip, deflate, br\\nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\\nHost: OMITTED:443\\nUser-Agent: Mozilla\\/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko\\/20100101 Firefox\\/52.0\", \"requestGuid\": \"OMITTED\", \"sessionId\": \"OMITTED\", \"requestGuid\": \"OMITTED\", \"userId\": \"<none>\", \"UserLanguages\": \"zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\", \"CurrentCulture\": \"en-US\", \"CurrentUICulture\": \"en-US\", \"Headers\": \"GET \\/\\nRemote Address: OMITTED\\n\\nAccept: application\\/json, text\\/plain, *\\/*\\nAccept-Charset: GBK,utf-8;q=0.7,*;q=0.3\\nAccept-Encoding: gzip, deflate, br\\nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\\nHost: OMITTED:443\\nUser-Agent: Mozilla\\/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko\\/20100101 Firefox\\/52.0\", \"RequestCtx\": \"Company.myapp.Web.Common.IoC.WebCommonLoggingContext\", \"LoggerType\": \"Company.myapp.Web.mysite.Controllers.HomeController\", \"Version\": \"4.1.0.132\", \"LogTimestamp\": \"2018-04-13T12:42:13.4539791Z\" }",
	  "type": "redis-input",
	  "RequestCtx": {
		"IpAddress": "OMITTED",
		"Url": "/"
	  },
	  "tags": []
	}
  }
```

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [July 12, 2018, 2:34pm UTC](https://discuss.elastic.co/t/all-fields-in-are-being-output-in-the-message-property-as-a-json-string/139543/4 "2018-07-12T14:34:03Z")

</div>

Ah, yeah the message is an encoded JSON string. I am not familiar with NLog, so you might want to reach out to them for guidance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2018, 2:34pm UTC](https://discuss.elastic.co/t/all-fields-in-are-being-output-in-the-message-property-as-a-json-string/139543/5 "2018-08-09T14:34:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.