Filebeat-5.5.1 got decoding JSON with a simple json line string

Elastic Stack Beats
1

filebeat-5.5.1 got decoding JSON with a simple json line string:

echo {"id":"l7KVoUhkRWWESd9QE_DX5Q", "timestamp":1502334971,"logtype":"event", "file":"tset.cpp", "function":"ProcMessageNew", "line":271} >> test.log

filebeat is monitoring the test file:

- input_type: log
  paths:
    - /root/test.log

also I try the newest version filebeat, got the same issue. @steffens

2

You have to explicitly enable json parsing. The way you use the echo command, without additional escaping I'm not sure a valid json line will be written to your log.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.