Elastic Search using Message Content Parse with Logstash

[Iker (Iker Saint)]

It's a better approach to parse the messages with a json filter, check these posts:

Parsing array of json objects with logstash and injesting to elastic

Thanks Badger. Unfortunately, it doesnt seem to do anything. I added the below, but it doesnt ingest anything. filter { json { source => "message" target => "someField" remove_field => [ "message" ] } split { field => "someField" } date { match => [ "[someField][date]", "YYYY-MM-dd'T'HH:mm:ssZZ" ] } }

Parse multiline JSON with grok in logstash