# Elastic search entry has JSON escaped in the message field

**URL:** https://discuss.elastic.co/t/elastic-search-entry-has-json-escaped-in-the-message-field/246856
**Category:** Elasticsearch
**Created:** [August 29, 2020, 8:43pm UTC](https://discuss.elastic.co/t/elastic-search-entry-has-json-escaped-in-the-message-field/246856 "2020-08-29T20:43:27Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![jordanr](https://avatars.discourse-cdn.com/v4/letter/j/9de053/32.png) [@jordanr](https://discuss.elastic.co/u/jordanr)
#### Post date: [August 29, 2020, 8:43pm UTC](https://discuss.elastic.co/t/elastic-search-entry-has-json-escaped-in-the-message-field/246856/1 "2020-08-29T20:43:27Z")

</div>

Good afternoon, we are configuring our elastic search stack and struggling with getting the message inside elastic search to reflect the format we desire.

We have php logs going to standard out, and the message is correct when we view the log in standard out. However, when we view that same log in elastic search via the API, the json is escaped.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/c/3c0d07dc2c70c2d58fbc68b3001296d3bc591e58.png)

We are pretty sure that the answer lies in the filebeat config, and we are using a decode\_json\_fields processor. But it is not making a significant difference. Could someone give us a little guidance on how to remove those escape characters?

Thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 26, 2020, 8:43pm UTC](https://discuss.elastic.co/t/elastic-search-entry-has-json-escaped-in-the-message-field/246856/2 "2020-09-26T20:43:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.