# Decode json logs filebeat docker hints-based autodiscover
**URL:** https://discuss.elastic.co/t/decode-json-logs-filebeat-docker-hints-based-autodiscover/185953
**Category:** Beats
**Tags:** filebeat
**Created:** [June 15, 2019, 9:14pm UTC](https://discuss.elastic.co/t/decode-json-logs-filebeat-docker-hints-based-autodiscover/185953 "2019-06-15T21:14:17Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@goekboet](https://discuss.elastic.co/u/goekboet)
#### Post date: [June 15, 2019, 9:14pm UTC](https://discuss.elastic.co/t/decode-json-logs-filebeat-docker-hints-based-autodiscover/185953/1 "2019-06-15T21:14:17Z")
TL;DR;
Can I have filebeat via hint-based autodiscover ship my json-formatted logs like:
```json
{
"@timestamp": "2019-06-15T19:48:04.963Z",
"foo": "bar"
}
```
instead of:
```json
{
"@timestamp": "2019-06-15T19:48:04.963Z",
"message": "{\"foo\":\"bar\"}"
}
```
I have an application running in docker that logs in json format to stdout. Then I have filebeat (also running in docker) shipping container logs. Now I'm wondering i it's possible to to decode the application logs and append the properties to the root of the object containing the docker metadata. The docs say neither yay or nay but I haven't been able to make it work. I have however been able to decode logs in other formats by adding a suitable label `co.elastic.logs/processors.dissect.tokenizer`. This is why I tried adding `co.elastic.logs/processors.decode_json_fields.fields`. No success. I've also had success with modules (i.e. `co.elastic.logs/module: "elasticsearch"`) to ship decoded logs with this setup.
I have a git repo reproducing my setup [here](https://github.com/goekboet/filebeat_json_issue)
---
### Author:  [@exekias](https://discuss.elastic.co/u/exekias)
#### Post date: [June 21, 2019, 1:00pm UTC](https://discuss.elastic.co/t/decode-json-logs-filebeat-docker-hints-based-autodiscover/185953/2 "2019-06-21T13:00:36Z")
Hi @goekboet,
I think it would make sense to introduce a new hint for this, in the same way we have some to do multiline, I could see these working good for your case:
```auto
co.elastic.logs/json.keys_under_root
co.elastic.logs/json.add_error_key
co.elastic.logs/json.message_key
```
I have created a new issue to track this, feel free to send your comments or subscribe for updates! [https://github.com/elastic/beats/issues/12634](https://github.com/elastic/beats/issues/12634)
---
### Author:  [@exekias](https://discuss.elastic.co/u/exekias)
#### Post date: [June 21, 2019, 1:18pm UTC](https://discuss.elastic.co/t/decode-json-logs-filebeat-docker-hints-based-autodiscover/185953/3 "2019-06-21T13:18:24Z")
Also as a different way of doing this, you could use the `processors` hint to leverage `decode_json_fields`, for example, something like this should work:
```auto
docker run -l co.elastic.logs/processors.0.decode_json_fields.fields=message -l co.elastic.logs/processors.0.decode_json_fields.target="" -it busybox echo '{"foo":"bar"}'
```
---
### Author:  [@goekboet](https://discuss.elastic.co/u/goekboet)
#### Post date: [June 21, 2019, 8:09pm UTC](https://discuss.elastic.co/t/decode-json-logs-filebeat-docker-hints-based-autodiscover/185953/4 "2019-06-21T20:09:31Z")
Thanks for the reply. I did some testing around with the processor hint but never got it working. The expected format for the fields hint was a bit unclear. If I didn't put it in a pair of brackets and quotes`["message"]` I'd get errors.
What I ended up doing was to come up with a label of my own `json_logger`-label and then in the filbeats config:
```auto
templates:
- condition:
equals:
docker.container.labels.json_logger: "True"
config:
- type: docker
containers.ids:
- "${data.docker.container.id}"
json.keys_under_root: true
json.add_error_key: true
```
This worked very fine but then I had some other issues with auto-discover so I ended up disabling it.
I liked the hints-based approach though. I could put config in the docker-compose file and have the config be there together with other variables.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 19, 2019, 8:09pm UTC](https://discuss.elastic.co/t/decode-json-logs-filebeat-docker-hints-based-autodiscover/185953/5 "2019-07-19T20:09:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.