All JSON inside message property

Elastic Stack Beats
1

I want to log my NodeJS logs which written to a file.
I have configure filebeat to read those files and pass them to my self-managed elasticsearch + kibana.
All the json content is written to the message property.
I want to make this json to be in the root log so i can use the keys to search etc..
Here is my filebeat.inputs in filebeat.yml file

filebeat.inputs:
  - type: filestream
    id: my-filestream-id
    enabled: true
    paths:
      - /MY/PATH/TO/JSON/FILE/app.json
    json.keys_under_root: true
    json.overwrite_keys: true
    json.add_error_key: true
    json.expand_keys: true
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.