# Append json to log message

**URL:** <https://discuss.elastic.co/t/append-json-to-log-message/49209>\
**Category:** Logstash\
**Created:** [May 4, 2016, 5:46pm UTC](https://discuss.elastic.co/t/append-json-to-log-message/49209 "2016-05-04T17:46:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brandon\_Metcalf](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@Brandon\_Metcalf](https://discuss.elastic.co/u/Brandon_Metcalf)\
**Post date:** [May 4, 2016, 5:46pm UTC](https://discuss.elastic.co/t/append-json-to-log-message/49209/1 "2016-05-04T17:46:53Z")

</div>

We are using an output filter on our senders that looks like

output {

tcp {  
host =\> "log.host"  
port =\> 2009  
mode =\> "client"  
codec =\> "json\_lines"  
workers =\> 1  
}

}

and on the receiver:

input {

tcp {  
mode =\> "server"  
port =\> 2009  
codec =\> "json"  
}

}

output {

file {  
path =\> "/path/%{lm-host}/%{path}"  
codec =\> "json"  
message\_format =\> "%{message}"  
workers =\> 1  
}

}

I would like to append a json structure to end of each message that gets written to our log files without changing the rest of the message. Basically, something like

this is a log message. { "key1": "value1", "key2": "value2" }

The key/value pairs would be added on the sender and ideally, we could additional pairs on the sender without further modifications on the receiver.

Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 5, 2016, 11:24pm UTC](https://discuss.elastic.co/t/append-json-to-log-message/49209/2 "2016-05-05T23:24:55Z")

</div>

> [@Brandon\_Metcalf](#):
>
> The key/value pairs would be added on the sender

Anything sent from the generating host into the input would be treated as part of the message.  
However you could use grok to separate the KV sections.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/append-json-to-log-message/49209/3 "2017-07-06T04:59:09Z")

</div>