FileBeat 5 - Parsing JSON - Why can't it parse the whole line

(Yarden Bar) #1

As documented, in order to parse json line logs, the json object must contain a key to pull the message object from.

Is there a particular reason that FB won't have the ability to parse the whole line (assuming that its a valid JSON object)?

Thank you,

(Andrew Kroh) #2

It will parse the whole JSON object and include it in the event.

The message_key is optional. "If no text key is defined, the line filtering and multiline features cannot be used."

(Yarden Bar) #3

Thank you, @andrewkroh !

Its working as expected :smile:

(system) #4

This topic was automatically closed after 21 days. New replies are no longer allowed.