# Configuring filebeat for parsing JSON formatted messages

**URL:** https://discuss.elastic.co/t/configuring-filebeat-for-parsing-json-formatted-messages/192324
**Category:** Beats
**Tags:** filebeat
**Created:** [July 25, 2019, 9:16pm UTC](https://discuss.elastic.co/t/configuring-filebeat-for-parsing-json-formatted-messages/192324 "2019-07-25T21:16:01Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Karthik2411](https://avatars.discourse-cdn.com/v4/letter/k/ed8c4c/32.png) [@Karthik2411](https://discuss.elastic.co/u/Karthik2411)
#### Post date: [July 25, 2019, 9:16pm UTC](https://discuss.elastic.co/t/configuring-filebeat-for-parsing-json-formatted-messages/192324/1 "2019-07-25T21:16:01Z")

</div>

Hello @Brandon_Kobel. We are using filebeat on windows. We are forwarding messages using filebeat to ELK. The messages are coming in as is from the JSON Index. I am wondering If we need to change anything in the filebeat.yml file. I am pasting the configuration below. please take a look at it and let me know if I need to change anything in order to break the messages into individual JSON events.

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so

# you can use different prospectors for various configurations.

# Below are the prospector specific configurations.

- input\_type: log

- input\_type: log

processors:

- drop\_fields:  
fields: ["host"]  
#================================ General =====================================

# The name of the shipper that publishes the network data. It can be used to group

# all the transactions sent by a single shipper in the web interface.

#name:

# The tags of the shipper are included in their own field with each

# transaction published.

#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the

# output.

#fields:

# env: staging

#================================ Outputs =====================================

# Configure what outputs to use when sending the data collected by the beat.

# Multiple outputs may be used.

#------------------------- Kafka output --------------------------------  
output.kafka:  
hosts: ["10.29.42.141:9092"]

# message topic selection + partitioning

topic: 'waplab\_logstash\_crs\_pda\_clp'  
partition.round\_robin:  
reachable\_only: false

required\_acks: 1  
compression: gzip  
max\_message\_bytes: 1000000

#-------------------------- Elasticsearch output ------------------------------  
#output.elasticsearch:

# Array of hosts to connect to.

# hosts: ["localhost:9200"]

# Optional protocol and basic auth credentials.

#protocol: "https"  
#username: "elastic"  
#password: "changeme"

#----------------------------- Logstash output --------------------------------  
#output.logstash:

# The Logstash hosts

#hosts: ["localhost:5044"]

# Optional SSL. By default is off.

# List of root certificates for HTTPS server verifications

#ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"]

# Certificate for SSL client authentication

#ssl.certificate: "/etc/pki/client/cert.pem"

# Client Certificate Key

#ssl.key: "/etc/pki/client/cert.key"

#================================ Logging =====================================

# Sets log level. The default log level is info.

# Available log levels are: critical, error, warning, info, debug

logging.level: info

# files.

logging.to\_files: true  
logging.files:

# Configure the path where the logs are written. The default is the logs directory

# under the home path (the binary location).

#path: /var/log/winlogbeat  
path: C:\QlikShare\Filebeats\log\

# The name of the files where the logs are written to.

name: filebeat

# Configure log file size limit. If limit is reached, log file will be

# automatically rotated

rotateeverybytes: 10485760 # = 10MB

# Number of rotated log files to keep. Oldest files will be deleted first.

keepfiles: 7

# At debug level, you can selectively enable logging only for some components.

# To enable all selectors use ["\*"]. Examples of other selectors are "beat",

# "publish", "service".

#logging.selectors: ["\*"]

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2019, 9:16pm UTC](https://discuss.elastic.co/t/configuring-filebeat-for-parsing-json-formatted-messages/192324/2 "2019-08-22T21:16:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.