# Double values filebeat

**URL:** <https://discuss.elastic.co/t/double-values-filebeat/328217>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 22, 2023, 8:09am UTC](https://discuss.elastic.co/t/double-values-filebeat/328217 "2023-03-22T08:09:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrispos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrispos/32/116774_2.png) [@chrispos](https://discuss.elastic.co/u/chrispos)\
**Post date:** [March 22, 2023, 8:09am UTC](https://discuss.elastic.co/t/double-values-filebeat/328217/1 "2023-03-22T08:09:16Z")

</div>

Hello,

I'm trying to read my log server.json into logstash /kibana. Now I have opened a [topic](https://discuss.elastic.co/t/json-parsin/326849/11) for this before, and I was advised to ask further questions in the filebeat forum. For the record.

I've already gotten a little further than my first problem I had in the previous topic.

Currently kibana shows double values I think (see image, marked with a red circle )

 ![2023-03-21 17_02_16-Discover - Elastic en nog 10 andere pagina's - Profiel 1 - Microsoft​ Edge](https://us1.discourse-cdn.com/elastic/original/3X/3/4/34158db5e82e7d7458a2ad533a75a042f2449ae9.png)  
 ![2023-03-22 08_52_18-Discover - Elastic en nog 11 andere pagina's - Profiel 1 - Microsoft​ Edge](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6fbbb7de35a98b95957ada12442954094970e3fd.png)

This is my filebeat.yml

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /opt/rh/eap7/piet/usr/share/wildfly/standalone/log/server.json
# multiline.pattern: '^{'
  multiline.pattern: '^$'
  multiline.negate: true
  multiline.match: after
  processors:
# - decode_json_fields:
# fields: ["message"]
# target: "json"
output.logstash:
  hosts: ["xxx.xxx.xxx.xxx:5044"]
```

The # are a result of my trail and error method. I have no clear reasons why I did that.. (sorry i am new in the IT)

and this is my logstash file.

```auto
input {
    beats {
        port => "5044"
    }
}
filter {
    json {
        source => "message"
    }
}
output{
    elasticsearch{
        hosts => ["localhost:9200"]
        index => "data"
    }
}
```

I may be doing something wrong. Unfortunately, I haven't been working in IT for very long. My filebeat.yml is based on some reading and some cutting and pasting (trial and error and it looks better then before). I'm a bit further, but it would be nice if I didn't get double values. Hopefully someone can help me.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2023, 10:09am UTC](https://discuss.elastic.co/t/double-values-filebeat/328217/2 "2023-04-19T10:09:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.