# Docker input via autodiscovery not always json-decoding message
**URL:** https://discuss.elastic.co/t/docker-input-via-autodiscovery-not-always-json-decoding-message/157859
**Category:** Beats
**Tags:** filebeat
**Created:** [November 22, 2018, 10:41am UTC](https://discuss.elastic.co/t/docker-input-via-autodiscovery-not-always-json-decoding-message/157859 "2018-11-22T10:41:05Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@lifeofguenter](https://discuss.elastic.co/u/lifeofguenter)
#### Post date: [November 22, 2018, 10:41am UTC](https://discuss.elastic.co/t/docker-input-via-autodiscovery-not-always-json-decoding-message/157859/1 "2018-11-22T10:41:06Z")
using the docker-input it seems that sometimes the message is a json:
```auto
logstash_1_7c18eb226755 | "message" => "{\"log\":\"192.168.80.1 - - [22/Nov/2018:10:38:46 +0000] \\\"GET / HTTP/1.1\\\" 200 612 \\\"-\\\" \\\"curl/7.47.0\\\" \\\"localhost:8181\\\"\\n\",\"stream\":\"stdout\",\"time\":\"2018-11-22T10:38:46.945703331Z\"}",
```
and sometimes the message is json decoded:
```auto
logstash_1_f7e7e988a4af | "@version" => "1",
logstash_1_f7e7e988a4af | "offset" => 0,
logstash_1_f7e7e988a4af | "stream" => "stdout",
logstash_1_f7e7e988a4af | "host" => {
logstash_1_f7e7e988a4af | "name" => "f3135fa546a2"
logstash_1_f7e7e988a4af | },
logstash_1_f7e7e988a4af | "source" => "/var/lib/docker/containers/c5b44c22a654d4622af2ad0df971d3eee35db318cccaf88ea9fb1a877882c108/c5b44c22a654d4622af2ad0df971d3eee35db318cccaf88ea9fb1a877882c108-json.log",
logstash_1_f7e7e988a4af | "message" => "172.26.0.1 - - [22/Nov/2018:10:16:04 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.47.0\" \"-\""
logstash_1_f7e7e988a4af | }
```
---
### Author:  [@lifeofguenter](https://discuss.elastic.co/u/lifeofguenter)
#### Post date: [November 22, 2018, 1:16pm UTC](https://discuss.elastic.co/t/docker-input-via-autodiscovery-not-always-json-decoding-message/157859/2 "2018-11-22T13:16:46Z")
actually this is also happening when running filebeat natively (via official apt repo).
---
### Author:  [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [November 22, 2018, 1:59pm UTC](https://discuss.elastic.co/t/docker-input-via-autodiscovery-not-always-json-decoding-message/157859/3 "2018-11-22T13:59:20Z")
A few questions, which version are you running?
Is there any JSON parsing error on the Filebeat side?
---
### Author:  [@lifeofguenter](https://discuss.elastic.co/u/lifeofguenter)
#### Post date: [November 22, 2018, 3:33pm UTC](https://discuss.elastic.co/t/docker-input-via-autodiscovery-not-always-json-decoding-message/157859/4 "2018-11-22T15:33:48Z")
Right now it seems the `autodiscovery` plugin for `docker` is faulty. You can easily replicate by running filebeat as docker container and even natively.
There is no JSON error, but sometimes filebeat will json\_decode the `message` field and sometimes not. As shown in my example above.
It ties to this problem as well: [Docker + Persistent Registry = autodiscover failing](https://discuss.elastic.co/t/docker-persistent-registry-autodiscover-failing/157688/4)
Once I switch away from autodiscovery everything works perfectly.
---
### Author:  [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [November 26, 2018, 1:23pm UTC](https://discuss.elastic.co/t/docker-input-via-autodiscovery-not-always-json-decoding-message/157859/5 "2018-11-26T13:23:56Z")
@lifeofguenter Thanks, I will let @exekias handle the issue in the other thread, he know everything about that part 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 24, 2018, 1:23pm UTC](https://discuss.elastic.co/t/docker-input-via-autodiscovery-not-always-json-decoding-message/157859/6 "2018-12-24T13:23:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.