# Filebeat 7.1 UDP + JSON
**URL:** https://discuss.elastic.co/t/filebeat-7-1-udp-json/205115
**Category:** Beats
**Tags:** filebeat
**Created:** [October 24, 2019, 3:50pm UTC](https://discuss.elastic.co/t/filebeat-7-1-udp-json/205115 "2019-10-24T15:50:36Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Serg](https://discuss.elastic.co/u/Serg)
#### Post date: [October 24, 2019, 3:50pm UTC](https://discuss.elastic.co/t/filebeat-7-1-udp-json/205115/1 "2019-10-24T15:50:36Z")
Hi
I try to use such config to get data from my app. on UDP socket in JSON format.
I hope it will help to mark all fields automatically (like in GELF driver)
> filebeat.inputs:
>
> ```
> - type: udp
> host: "localhost:9099"
> max_message_size: 100KiB
>
> filebeat.config.modules:
> path: ${path.config}/modules.d/*.yml
> reload.enabled: false
>
> setup.template.settings:
> index.number_of_shards: 3
>
> setup.kibana:
> host: "1.1.1.1:5601"
>
> output.elasticsearch:
>
> hosts: ["1.1.1.2:9200"]
> indices:
> - index: "system-%{[agent.version]}-%{+yyyy.MM.dd}"
> when.equals:
> event.module: "system"
> - index: "drupal-%{[agent.version]}-%{+yyyy.MM.dd}"
>
> processors:
> - add_cloud_metadata: ~
> - add_host_metadata:
> netinfo.enabled: true
> cache.ttl: 5m
> - decode_json_fields:
> fields: ["message"]
> process_array: true
> max_depth: 10
> overwrite_keys: true
>
> ```
But I've got such kind of error in filebeat logs, could plz tell what I am doing wrong?
Private:interface {}(nil)}, Flags:0x1} (status=400):
> {"type":"mapper\_parsing\_exception","reason":"failed to parse field [message] of type [text] in document with id 'JGNk\_m0BojXHgnHnNPHC'","caused\_by":{"type":"illegal\_state\_exception","reason":"Can't get text on a START\_OBJECT at 1:366"}}
From app side for integration I use monolog, it could send valid JSON data
---
### Author:  [@pmercado](https://discuss.elastic.co/u/pmercado)
#### Post date: [October 25, 2019, 11:47am UTC](https://discuss.elastic.co/t/filebeat-7-1-udp-json/205115/2 "2019-10-25T11:47:27Z")
Hi @Serg,
can this be that the index mapping already exists as `text` at elasticsearch, and you are trying to use it as an object (after being JSON decoded)?
Can you retry using `target` element at your configuration to write to a non already mapped field?
[https://www.elastic.co/guide/en/beats/filebeat/current/decode-json-fields.html](https://www.elastic.co/guide/en/beats/filebeat/current/decode-json-fields.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 22, 2019, 11:47am UTC](https://discuss.elastic.co/t/filebeat-7-1-udp-json/205115/3 "2019-11-22T11:47:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.