# Converting filebeat message with logstash
**URL:** https://discuss.elastic.co/t/converting-filebeat-message-with-logstash/336931
**Category:** Logstash
**Created:** [June 26, 2023, 9:29pm UTC](https://discuss.elastic.co/t/converting-filebeat-message-with-logstash/336931 "2023-06-26T21:29:45Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@fizem](https://discuss.elastic.co/u/fizem)
#### Post date: [June 26, 2023, 9:29pm UTC](https://discuss.elastic.co/t/converting-filebeat-message-with-logstash/336931/1 "2023-06-26T21:29:45Z")
Hi,
I have setup filebeat to parse my API logs and send messages to a centralized logstash cluster.
> filebeat will collect all the logs with a minimum CPU consumption.
> logstash can transform the data, define multiple pipelines on dedicated servers and send the output to Elasticsearch.
When parsing the log, filebeat
> stores each line of my log in key call messages and the value is a complex json object.
> example :
```auto
"messages" : "{"key1":"value1","key2":"value2","key3":"value3","key4":"value4","key5":"value5"}"
```
> sends the filebeat event to logstash which sends it elasticsearch
When ELK stores the document, it contains a key :
```auto
"messages" :" {"key1":"value1","key2":"value2","key3":"value3","key4":"value4","key5":"value5"}"
```
I would like to have each key / value as part of entry in the Elastic document
```auto
{
"@timestamp": "XXXX-XX-XXTHH:MM:SS",
"key1":"value1",
"key2":"value2",
"key3":"value3",
"key4":"value4",
"key5":"value5"
}
```
How can achieved that. I don't want to install logstash on each API server to parse logs (based on logback).
Regards,
Farid
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 26, 2023, 9:32pm UTC](https://discuss.elastic.co/t/converting-filebeat-message-with-logstash/336931/2 "2023-06-26T21:32:37Z")
What does your logstash configuration looks like?
You need to parse the message in logstash using a `json` filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 24, 2023, 9:33pm UTC](https://discuss.elastic.co/t/converting-filebeat-message-with-logstash/336931/3 "2023-07-24T21:33:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.