# Filebeat 6.3.1 UDP + Json

**URL:** https://discuss.elastic.co/t/filebeat-6-3-1-udp-json/140624
**Category:** Beats
**Tags:** filebeat
**Created:** [July 18, 2018, 9:09pm UTC](https://discuss.elastic.co/t/filebeat-6-3-1-udp-json/140624 "2018-07-18T21:09:33Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ateixeira-pt](https://avatars.discourse-cdn.com/v4/letter/a/a6a055/32.png) [@ateixeira-pt](https://discuss.elastic.co/u/ateixeira-pt)
#### Post date: [July 18, 2018, 9:09pm UTC](https://discuss.elastic.co/t/filebeat-6-3-1-udp-json/140624/1 "2018-07-18T21:09:33Z")

</div>

Hi,

I'm trying to send a JSON Log over UDP, so filebeat forwards it to the ElasticSearch.  
The thing is, I can't get it to decode the JSON payload

I also tried with a \n and a \n\n to no luck

```
{
  "@timestamp": "2018-07-18T21:11:57.266Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "doc",
    "version": "6.3.1",
    "truncated": false
  },
  "input": {
    "type": "udp"
  },
  "prospector": {
    "type": "udp"
  },
  "beat": {
    "name": "dad20104e72c",
    "hostname": "dad20104e72c",
    "version": "6.3.1",
    "timezone": "+00:00"
  },
  "host": {
    "name": "dad20104e72c",
    "architecture": "x86_64",
    "os": {
      "family": "debian",
      "codename": "xenial",
      "platform": "ubuntu",
      "version": "16.04.4 LTS (Xenial Xerus)"
    },
    "id": "b987bfc2295c4e82afddb796793d7ac1",
    "containerized": true
  },
  "source": "127.0.0.1:40783",
  "message": "{\"inner\":\"John\",\"outer\":30}"
}

```

Python Script

```
import socket
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(bytes('{"inner":"John","outer":30}','utf-8'), ('127.0.0.1', 7070))

```

Netcat Debug

```
nc -ul 127.0.0.1 -p 7070
{"inner":"John","outer":30}

```

Filebeat Version

```
filebeat version 6.3.1 (amd64), libbeat 6.3.1 [ed42bb85e72ae58cc09748dc1825159713e0ffd4 built 2018-06-29 21:09:35 +0000 UTC]

```

Python 3 Version

```
Python 3.6.5 (default, May 3 2018, 10:08:28)
[GCC 5.4.0 20160609] on linux

```

Filebeat .yml

```
filebeat.prospectors:
- type: udp
  max_message_size: 10KiB
  host: "localhost:7070"
  enabled: true
  processors:
  - add_locale: ~
  - add_host_metadata: ~
  - decode_json_fields:
      fields: ["inner", "outer"]

output.console:
  pretty: true

logging.level: debug
```

---

<div class="post-metadata">

### Author: ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [July 18, 2018, 9:25pm UTC](https://discuss.elastic.co/t/filebeat-6-3-1-udp-json/140624/2 "2018-07-18T21:25:35Z")

</div>

I see, the issue here is some confusion over the `decode_json_fields` option. That option specifies what the _source_ field is that you want to decode. If you look at the output you posted above, the JSON is all in the `message` field. You'll need to use a config like:

```auto
filebeat.prospectors:
- type: udp
  max_message_size: 10KiB
  host: "localhost:7070"
  enabled: true
  processors:
  - add_locale: ~
  - add_host_metadata: ~
  - decode_json_fields:
      fields: ["message"]

output.console:
  pretty: true

logging.level: debug

```

That will decode the fields. You may also want to [rename](https://www.elastic.co/guide/en/beats/filebeat/6.x/rename-fields.html) those fields once they're decoded.

---

<div class="post-metadata">

### Author: ![ateixeira-pt](https://avatars.discourse-cdn.com/v4/letter/a/a6a055/32.png) [@ateixeira-pt](https://discuss.elastic.co/u/ateixeira-pt)
#### Post date: [July 18, 2018, 9:31pm UTC](https://discuss.elastic.co/t/filebeat-6-3-1-udp-json/140624/3 "2018-07-18T21:31:10Z")

</div>

Hi @Andrew_Cholakian1

You are completely right ! , it's working as expect maybe I recommend the presence of an example on the Decode Json Fields page.

Thank your for your time 🙂  
Antonio

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 15, 2018, 9:41pm UTC](https://discuss.elastic.co/t/filebeat-6-3-1-udp-json/140624/4 "2018-08-15T21:41:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.