# Filebeat HttpJson Input Plugin Didnt Work Correctly

**URL:** <https://discuss.elastic.co/t/filebeat-httpjson-input-plugin-didnt-work-correctly/280435>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 4, 2021, 1:21pm UTC](https://discuss.elastic.co/t/filebeat-httpjson-input-plugin-didnt-work-correctly/280435 "2021-08-04T13:21:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kolten](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kolten/32/35725_2.png) [@kolten](https://discuss.elastic.co/u/kolten)\
**Post date:** [August 4, 2021, 1:21pm UTC](https://discuss.elastic.co/t/filebeat-httpjson-input-plugin-didnt-work-correctly/280435/1 "2021-08-04T13:21:03Z")

</div>

Hi everyone,

I want to try httpjson plugin but it didnt work correctly. Filebeat transfer data with binary format so that data didn't correct.

I followed this article: [HTTP JSON input | Filebeat Reference [7.14] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html)

Here is my filebeat config:

```auto
filebeat.inputs:
# Fetch your public IP every minute.
- type: httpjson
  config_version: 2
  interval: 1m
  request.url: https://api.ipify.org/?format=json
  processors:
    - decode_json_fields:
        fields: ["message"]
        target: "json"

output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5045"]

```

Logstash config:

```auto
input {
   tcp {
      port => 5045
   }
}
output {
  elasticsearch {
     hosts => ["localhost:9200"]
     index => "logstash-jsontest2-%{+YYYY.MM.dd}"
  }
}

```

Incoming data:

```auto
2W\u0000\u0000\u0000\u00012C\u0000\u0000\u00010x^|\x91Mn\x830\u0010\x85\xC9Ufm#c\x9B@\xBCʺ\xEB\xAE*\xA4hl\x86@\u0015~\x84\x9DH\u0015\xE2̽Be\x9A\xAA\xADRu\xE5\x85\xE7\xBD\xF9>\x8D|J\x92d\x97$\xBB\xF7\u0005\x8E\xA1\xEB\xC9\a\xEC'0 \x85̸(\xB9\xD0ϙ2\x990J\xA4R\xA9\u0017`p\xEC)`\x8D\u0001\xC1,`\t\u0003\u0018h\xBA\vY\xC2\u0000\f\xC2\xDBD`\xE0T\x8F\u000E\u0018\xDCh\xF6\xDD8\x80\x81\"\xCDt*`e@7\u001AB\f\xBB\x990P\xFDߺ\x95AO\xDE\xE39v.\u0015tS\u0005\xA6\u0002U\xA4R\xC84\xCFS\xA9e\u0005+0\xE8\x86麵\xDE\u0001\xDA\u0010\xA6W?\u000E\xB1b{\xCD\u0002]T\xFB\x95\xDDx\x9C\x8F\x9FߨY\x9A\x89O\xD4v\xF4[\xE7\x80}\u0004\xB8\x8Cg?^gG>\xE6\xF0|\xF7hG\u001F\u001E'\u0018\xD0\xD4RO3^N]\x94\xA4\xB2,\xADFǵ,J\xAEQ!\xB799\x8E\xE2p\xB0\xE5~\xDFhYG\x918\x9B\u0017\xB6\xC1B[n\v%\xB9\x96Zr\x9Bۆ\xBB\xACv\xAA\xA8\xF7\a,s`\u007Fp\xB1/\xFF\u001F'y<\xC2\xFA1\u0000\tW\x92\xFE2W\u0000\u0000\u0000\u00012C\u0000\u0000\u0001/x^|\x90\xBD\x8A\xE30\u0014\x85\x9DW\xB9\xB5d$Y\x8E\u001CU\xA9\xB7\xDEj1\x84+\xF9:\xF1\u0012\xFF`)\x81\xC5\xF8\x99\xF7\u0015\u00069\u0019f\x86\tS\xA98:\xE7~|\xEAW\x96e\xBB,\xDB\xFD_\xE0\u0018\xBB\x9EB\xC4~\u0002\vJ(\xC9EŅ\xFE-\v+\xA5-d.\xA4\xF9\u0003\f\x8E=El0\"\xD8\u0005\u001Ca\u0004\vmw%G\u0018\x81A\xFC7\u0011X85\xA3\a\u0006w\x9AC7\u000E`\xC1\xE4R\xE7\u0002V\u0006\xE4C\xAA~D2\x97\xE2\u0011]\xC6\u0010S6`\x9FF\xAE\xE39\x8C\xB7\xD9S\xD8zw\u001A\xB6\xD4τ\x91\x9A\x9F0W\u0006=\x85\x80\xE74\xB3\xD4\xD0M5\xD8\u001A

```

What do i need to do?

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [August 4, 2021, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-httpjson-input-plugin-didnt-work-correctly/280435/2 "2021-08-04T13:37:03Z")

</div>

Can u show what the document in elasticsearch looks like?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2021, 3:37pm UTC](https://discuss.elastic.co/t/filebeat-httpjson-input-plugin-didnt-work-correctly/280435/3 "2021-09-01T15:37:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.