# Filebeat: error json decode

**URL:** https://discuss.elastic.co/t/filebeat-error-json-decode/285302
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [September 28, 2021, 5:14am UTC](https://discuss.elastic.co/t/filebeat-error-json-decode/285302 "2021-09-28T05:14:10Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![mohammed.sabil](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)
#### Post date: [September 28, 2021, 5:14am UTC](https://discuss.elastic.co/t/filebeat-error-json-decode/285302/1 "2021-09-28T05:14:11Z")

</div>

Hello Team and @john.akash,

Hope you are doing good.

I am also trying to push log message data to ES so that I can filter the data and create visualization.

Here is my sample log

```auto
 "@timestamp" => 2021-09-28T04:51:22.169Z,
logstash_1 | "message" => "2021-03-17:00:00:54 +0000 | GET | 301 | 0 | 261 | check_http/v2.2 (monitoring-plugins 2.2) | 80",
logstash_1 | "host" => {
logstash_1 | "name" => "xxxxxxxx"
logstash_1 | }

```

Sample data

```auto
2021-03-17:00:00:54 +0000 | GET | 301 | 0 | 261 | check_http/v2.2 (monitoring-plugins 2.2) | 80
2021-03-17:00:00:54 +0000 | GET | 404 | 0 | 261 | check_http/v2.2 (monitoring-plugins 2.2) | 80
2021-03-17:00:00:54 +0000 | GET | 501 | 0 | 261 | check_http/v2.2 (monitoring-plugins 2.2) | 80

```

File beat input file.

```auto
filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

processors:
- add_cloud_metadata: ~

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - "/var/log/test.log"
  exclude_files: ['\.gz$']
  json.message_key: GET
  json.keys_under_root: true
  json.add_error_key: true

  #output.elasticsearch:
  #hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'

output.logstash:
  hosts: ["logstash:5044"]

```

Still I am getting error decode json issue. Can you please suggest/assist me on this?

Regards,  
Sabil.

---

<div class="post-metadata">

### Author: ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [September 29, 2021, 9:37pm UTC](https://discuss.elastic.co/t/filebeat-error-json-decode/285302/2 "2021-09-29T21:37:47Z")

</div>

I don't see any JSON in what u posted.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 27, 2021, 9:38pm UTC](https://discuss.elastic.co/t/filebeat-error-json-decode/285302/3 "2021-10-27T21:38:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.