# ELK6.0 with filebeat

**URL:** <https://discuss.elastic.co/t/elk6-0-with-filebeat/313154>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 29, 2022, 11:23am UTC](https://discuss.elastic.co/t/elk6-0-with-filebeat/313154 "2022-08-29T11:23:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lalitg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lalitg/32/110200_2.png) [@lalitg](https://discuss.elastic.co/u/lalitg)\
**Post date:** [August 29, 2022, 11:23am UTC](https://discuss.elastic.co/t/elk6-0-with-filebeat/313154/1 "2022-08-29T11:23:35Z")

</div>

Hi,

I configure ELK6.0 with filebeat to read logs files generated with log4j. I got below output

{  
"\_index": "filebeat-6.0.0",  
"\_type": "doc",  
"\_id": "GawR6YIBaCy-nPSp4SyK",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"@timestamp": "2022-08-29T10:07:18.372Z",  
"offset": 31456502,  
"@version": "1",  
"beat": {  
"name": "C-CND1312WKH",  
"hostname": "C-CND1312WKH",  
"version": "6.0.0"  
},  
"host": "C-CND1312WKH",  
"prospector": {  
"type": "log"  
},  
"ERROR": "WARN",  
"source": "C:\phoenix\logs\SPSServer.0.log",  
"message": "{"host":"ME1","level":"WARN","log":{"classname":"org.apache.kafka.clients.NetworkClient:776","message":"[Producer clientId=producer-23] Connection to node -1 (localhost/127.0.0.1:9092) could not be established. Broker may not be available.","stacktrace":"","threadname":"kafka-producer-network-thread | producer-23"},"process":"processDisconnection","service":"","time":"2022-07-04T10:57:31.076Z","timezone":"UTC","type":"log"}",  
"tags": [  
"beats\_input\_codec\_plain\_applied",  
"SPS"  
]  
},  
"fields": {  
"@timestamp": [  
"2022-08-29T10:07:18.372Z"  
]  
},  
"highlight": {  
"tags.keyword": [  
"@kibana-highlighted-field@SPS@/kibana-highlighted-field@"  
],  
"tags": [  
"@kibana-highlighted-field@SPS@/kibana-highlighted-field@"  
]  
},  
"sort": [  
1661767638372  
]  
}

My requirement is to have inner json associated with message should be available for querying. I tried KQL, look for filebeat module,filebeat filter , logstash plugin. but didn't get any satisfactory options. please help. do i need to write some module/plugin to parse input as per my requirements?

Regards,  
Lalit

---

<div class="post-metadata">

**Author:** ![MichelLaterman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michellaterman/32/110221_2.png) [@MichelLaterman](https://discuss.elastic.co/u/MichelLaterman)\
**Post date:** [September 1, 2022, 7:20pm UTC](https://discuss.elastic.co/t/elk6-0-with-filebeat/313154/2 "2022-09-01T19:20:23Z")

</div>

Hi the 6.X releases are past EOL, we advise that you update to a more current release.

I believe that the [Decode JSON fields | Filebeat Reference [8.4] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/decode-json-fields.html) processor may be what you're looking for  
The 6.0 docs for it are [Decode JSON fields | Filebeat Reference [6.0] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/6.0/decode-json-fields.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 29, 2022, 9:21pm UTC](https://discuss.elastic.co/t/elk6-0-with-filebeat/313154/3 "2022-09-29T21:21:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.