# Extract field's from a message field

**URL:** <https://discuss.elastic.co/t/extract-fields-from-a-message-field/273978>\
**Category:** Logstash\
**Created:** [May 25, 2021, 5:41pm UTC](https://discuss.elastic.co/t/extract-fields-from-a-message-field/273978 "2021-05-25T17:41:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Denilson-Semedo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/denilson-semedo/32/78791_2.png) [@Denilson-Semedo](https://discuss.elastic.co/u/Denilson-Semedo)\
**Post date:** [May 25, 2021, 5:41pm UTC](https://discuss.elastic.co/t/extract-fields-from-a-message-field/273978/1 "2021-05-25T17:41:10Z")

</div>

I'm colleting logs from a file .log:

`{"type":"audit_entry","created":"5/20/2021, 11:12:42 PM","colaborador_id":"cf7dc62b-dde9-4980-89d8-96eb5707876e","request_method":"PUT","ajax":false,"route":"/stock/artigos/8c443bfe-d077-46d2-805b-948c15534f2c","protocol":"https"}`

But I don't know how to catch all these fields. I put them in the elasticsearch and the JSON file is:

```
{
  "_index": "prod",
  "_type": "_doc",
  "_id": "8pWIpHkBSNn6S0YNSeBX",
  "_score": 1,
  "_source": {
"@version": "1",
"log": {
  "file": {
    "path": "/usr/share/prod/action.log"
  },
  "offset": 380990
},
"ecs": {
  "version": "1.6.0"
},
"agent": {
  "name": "ee0ccbef92f1",
  "type": "filebeat",
  "version": "7.11.0",
  "hostname": "ee0ccbef92f1",
  "ephemeral_id": "29f3e0e3-13be-40ac-abd9-35b688a5a177",
  "id": "5967388f-6559-4b97-87c7-79bb3b1a2179"
},
"message": "{\"type\":\"audit_entry\",\"created\":\"5/25/2021, 5:17:40 PM\",\"colaborador_id\":\"af4a57b5-c05f-446a-be65-97143d4629a5\",\"ip\":\"192.168.112.6\",\"request_method\":\"PUT\",\"ajax\":false,\"route\":\"/relacionamento/agendamento/c8492b33-4167-4466-abdd-d6729e38df2f\",\"protocol\":\"https\"}",
"tags": [
  "beats_input_codec_plain_applied"
],
"@timestamp": "2021-05-25T17:17:42.678Z",
"input": {
  "type": "log"
},
"host": {
  "name": "ee0ccbef92f1"
}
  },
  "fields": {
"@timestamp": [
  "2021-05-25T17:17:42.678Z"
]
  }
}

```

How I can structure the message field to catch all the fields is in the message?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2021, 5:41pm UTC](https://discuss.elastic.co/t/extract-fields-from-a-message-field/273978/2 "2021-06-22T17:41:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.