# Filebeat decode json processor

**URL:** https://discuss.elastic.co/t/filebeat-decode-json-processor/236770
**Category:** Beats
**Tags:** filebeat
**Created:** [June 11, 2020, 6:20pm UTC](https://discuss.elastic.co/t/filebeat-decode-json-processor/236770 "2020-06-11T18:20:34Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![venkat9731](https://avatars.discourse-cdn.com/v4/letter/v/bcef8e/32.png) [@venkat9731](https://discuss.elastic.co/u/venkat9731)
#### Post date: [June 11, 2020, 6:20pm UTC](https://discuss.elastic.co/t/filebeat-decode-json-processor/236770/1 "2020-06-11T18:20:34Z")

</div>

I am having an issue with my filebeat config  
Exiting: Error while initializing input: When using the JSON decoder and multiline together, you need to specify a message\_key value accessing  
filebeat.yml file

```auto
filebeat.inputs:
- type: container
  paths: 
    - '/var/lib/docker/containers/*/*.log'
  multiline.pattern: '^{'
  multiline.negate: true
  multiline.match: after
  json.keys_under_root: true
  json.overwrite_keys: true  

processors:
- add_docker_metadata:
    host: "unix:///var/run/docker.sock"  

- decode_json_fields:
    fields: ["log"]  
    overwrite_keys: true
    max_depth: 10

output.elasticsearch:
  hosts: [elasticsearch:9200]
  indices:
    - index: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"

logging.json: true
logging.metrics.enabled: false

```

and my log format is

```auto
{"@timestamp":"2020-06-11T18:01:27.098Z", "log.level": "INFO", "message":"200 OK: GET - "url", "service.name":"service name","event.dataset":"","process.thread.name":"thread nmae","log.logger":"Application","service.type":"application","request_uuid":"request_uuid"}

```

and also, how can I set the parameters such as request\_uuid under root instead of the message key.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 12, 2020, 11:38pm UTC](https://discuss.elastic.co/t/filebeat-decode-json-processor/236770/2 "2020-07-12T23:38:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.