# Can we use fileBeat to send jSON logs?

**URL:** https://discuss.elastic.co/t/can-we-use-filebeat-to-send-json-logs/116563
**Category:** Beats
**Tags:** filebeat
**Created:** [January 23, 2018, 1:11am UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-json-logs/116563 "2018-01-23T01:11:15Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![jpereira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpereira/32/26675_2.png) [@jpereira](https://discuss.elastic.co/u/jpereira)
#### Post date: [January 23, 2018, 1:11am UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-json-logs/116563/1 "2018-01-23T01:11:15Z")

</div>

Hi folks,

I have some logs on my system that are jSON payload and I would like to know if can I use the "beat" to handle/ship the logs to the ES.

e.g: fileBeat can do that? I have tried, but non-success.

````auto
filebeat.prospectors:
  - type: log
    enabled: true
    encoding: plain
    exclude_files: ['.gz$']
    scan_frequency: 1s
    paths:
      - /var/log/syslog-ng/json/node-token/*.log
    input_type: log

# Output
output.elasticsearch:
  protocol: https
  username: "myuser"
  password: "mypass"
  hosts: ["es.intra.net"]```
````

---

<div class="post-metadata">

### Author: ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [January 23, 2018, 2:16am UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-json-logs/116563/2 "2018-01-23T02:16:59Z")

</div>

Hello @jpereira,

Yes it's possible to process logs that have a JSON payload using the json options for the [prospector](https://www.elastic.co/guide/en/beats/filebeat/6.1/configuration-filebeat-options.html#config-json)

You can get a bit more details on this [discuss post](https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008/2?u=pierhugues) or this [blog post](https://www.elastic.co/blog/structured-logging-filebeat)

Thanks

---

<div class="post-metadata">

### Author: ![jpereira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpereira/32/26675_2.png) [@jpereira](https://discuss.elastic.co/u/jpereira)
#### Post date: [January 23, 2018, 10:24pm UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-json-logs/116563/3 "2018-01-23T22:24:59Z")

</div>

@pierhugues Thank you for taking the time to respond. Now is working perfectly!

ps: I have others issues, but I will create a new ticket.

---

<div class="post-metadata">

### Author: ![daved](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@daved](https://discuss.elastic.co/u/daved)
#### Post date: [January 23, 2018, 10:37pm UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-json-logs/116563/4 "2018-01-23T22:37:07Z")

</div>

Also check out this answer which has the stuff for the (latest) 6.1 elastic stack: [Custom filebeat template for JSON log lines](https://discuss.elastic.co/t/custom-filebeat-template-for-json-log-lines/114761/5)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 20, 2018, 10:37pm UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-json-logs/116563/5 "2018-02-20T22:37:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
