# Decode json in \_source into fields

**URL:** <https://discuss.elastic.co/t/decode-json-in--source-into-fields/92137>\
**Category:** Logstash\
**Created:** [July 6, 2017, 3:58pm UTC](https://discuss.elastic.co/t/decode-json-in--source-into-fields/92137 "2017-07-06T15:58:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 6, 2017, 3:58pm UTC](https://discuss.elastic.co/t/decode-json-in--source-into-fields/92137/1 "2017-07-06T15:58:49Z")

</div>

Hello,

I'm using Filebeat and Logstash to analyze logs from Wazuh, the logs are json files where each line is a json string, I can read the log correctly and push it into Elasticsearch, through Logstash, and it correctly populate the fields, but in the discover tab on Kibana, the \_source field shows the raw json.

Is there any way to decode the \_source raw json and show the fields in the discover tab?

This is what I'm getting now:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/2/c/2cddf066489205010150fbe21102c34dacdd4c31.png)

This is the way I want the \_source field to behave:  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/4/5/45bc4009422aa94502e3ac5050bc0f45974b5101.png)

My filebeat configuration is:

```auto
filebeat:
 prospectors:
  - input_type: log
    paths:
     - "/var/ossec/logs/alerts/alerts.json"
    document_type: wazuh-ossec
    codec: json_lines
    json.message_key: log
    json.keys_under_root: true
    json.overwrite_keys: true

output:
 logstash:
   hosts: ["10.114.243.54:5000"]

```

My logstash pipeline for this index is:

```auto
input {
	beats {
        host => "10.114.243.54"
        port => 5000
        codec => "json_lines"
        type => "wazuh-ossec"
	}
}
filter {
	if [type] == "wazuh-ossec" {
	        geoip {
                source => "srcip"
                target => "GeoLocation"
                fields => ["city_name", "continent_code", "country_code2", "country_name", "region_name", "location"]
        }
	        date {
                match => ["timestamp", "ISO8601"]
                target => "@timestamp"
        }
	        mutate {
                remove_field => ["timestamp", "beat", "fields", "input_type", "tags", "count", "@version", "log", "offset"]
         }
	}
}
output {
	if [type] == "wazuh-ossec" {
	        elasticsearch {
                hosts => ["localhost:9200"]
                index => "wazuh-alerts-%{+YYYY.MM.dd.HH}"
                codec => "json_lines"
                document_type => "wazuh-ossec"
                template => "/etc/logstash/wazuh-elastic5-template.json"
                template_name => "wazuh"
                template_overwrite => true
        }
    }
}

```

What am I missing?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 24, 2017, 5:47pm UTC](https://discuss.elastic.co/t/decode-json-in--source-into-fields/92137/2 "2017-07-24T17:47:46Z")

</div>

Hello,

With the help from the guys from the Wazuh mailing list I was able to solve the problem.

The solution was to explicit declare the \_source field as the value on the metaFields variable in the advanced settings on Kibana.

I don't know if this is the normal behavior, if I missed something or if it is a bug, but explicit declaring the values on the metaFields variable solves the problem.

![](https://us1.discourse-cdn.com/elastic/original/3X/5/b/5ba707c4f30d4e685c3e982e07fe1af3a0ab6f1e.png)

Just posting the solution before the topic closes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2017, 5:47pm UTC](https://discuss.elastic.co/t/decode-json-in--source-into-fields/92137/3 "2017-08-21T17:47:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.