# Automatic fields for a JSON input?

**URL:** <https://discuss.elastic.co/t/automatic-fields-for-a-json-input/57126>\
**Category:** Logstash\
**Created:** [August 3, 2016, 3:49pm UTC](https://discuss.elastic.co/t/automatic-fields-for-a-json-input/57126 "2016-08-03T15:49:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zesix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zesix/32/11162_2.png) [@Zesix](https://discuss.elastic.co/u/Zesix)\
**Post date:** [August 3, 2016, 3:49pm UTC](https://discuss.elastic.co/t/automatic-fields-for-a-json-input/57126/1 "2016-08-03T15:49:05Z")

</div>

I'm feeding JSON files to logstash from filebeat. Logstash is set to output JSON to ElasticSearch.

However, my JSON key-value pairs all show up as a giant clump within the "message" field. I believe ElasticSearch is designed to work with JSON files, so how can I have fields be automatically generated from the keys in my JSON?

For example this is what filebeat is outputting to logstash:

```
2016-08-02T14:53:58-05:00 DBG Publish: {
  "@timestamp": "2016-08-02T19:53:51.247Z",
  "beat": {
    "hostname": "USAUSWNCN094TTP",
    "name": "USAUSWNCN094TTP"
  },
  "count": 1,
  "fields": null,
  "input_type": "log",
  "message": "{\"LeadId\":22472,\"LeadGuid\":\"E1EB5EA4-E57F-41F0-AD95-FC215E2D8399\",\"CustomerFirstName\":\"NYLA\",\"CustomerCity\":\"atlanta\",\"CustomerState\":\"GA\",\"CustomerPostalCode\":\"21532\",\"CustomerCountryCode\":\"US\",\"CustomerLanguageCode\":\"en-us\",\"HasFilledOutAccessoryCoupon\":false,\"RequestedDealerContactAboutTrade\":false,\"HasFilledOutTradeInIncentiveCoupon\":false,\"HasAcknowledgedPrivacyPolicy\":true,\"HasAQuestionForDealer\":false,\"HasSelectedFandI\":true,\"HasSelectedAccessories\":true,\"HasGmRewardsCard\":false,\"HasSubmittedToDealer\":true,\"HasSubmittedCreditApplication\":false ...

```

However, the JSON file I am feeding in starts with the LeadId key-value pair. I don't want it all clumped up inside "message" because then I can't filter adequately using kibana after it gets sent to elastic.

Any ideas?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 5, 2016, 12:22am UTC](https://discuss.elastic.co/t/automatic-fields-for-a-json-input/57126/2 "2016-08-05T00:22:25Z")

</div>

Can you share a sample of the original file?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:44am UTC](https://discuss.elastic.co/t/automatic-fields-for-a-json-input/57126/3 "2017-07-06T04:44:44Z")

</div>

Closed on July 6, 2017, 4:44am UTC