# Filebeat ignore harvest JSON file

**URL:** https://discuss.elastic.co/t/filebeat-ignore-harvest-json-file/165163
**Category:** Beats
**Tags:** filebeat
**Created:** [January 22, 2019, 6:52am UTC](https://discuss.elastic.co/t/filebeat-ignore-harvest-json-file/165163 "2019-01-22T06:52:16Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Marek\_Pastier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marek_pastier/32/84932_2.png) [@Marek\_Pastier](https://discuss.elastic.co/u/Marek_Pastier)
#### Post date: [January 22, 2019, 6:52am UTC](https://discuss.elastic.co/t/filebeat-ignore-harvest-json-file/165163/1 "2019-01-22T06:52:16Z")

</div>

Hi guys  
My configuration for Filebeat ver 6.5 ignore harvesting json log file. My actual configuration **/etc/filebeat/filebeat.yml**

> filebeat.inputs:
> 
> - type: log  
> json.keys\_under\_root: true  
> json.add\_error\_key: true  
> paths:
> - /var/log/eset.log

example some lines from json files

**{"event\_type":"Threat\_Event","ipv4":"10.195.21.253"}**  
**{"event\_type":"Threat\_Event","ipv4":"10.195.21.253"}**

---

<div class="post-metadata">

### Author: ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)
#### Post date: [January 22, 2019, 10:31am UTC](https://discuss.elastic.co/t/filebeat-ignore-harvest-json-file/165163/2 "2019-01-22T10:31:21Z")

</div>

Hello @Marek_Pastier,  
try to use this

filebeat.prospectors:

- input\_type: log  
paths:
  - /home/rdave/Downloads/\*.json  
fields:  
service\_id: \*  
fields\_under\_root: true  
output.logstash:  
hosts: ['localhost:5044']

---

<div class="post-metadata">

### Author: ![Marek\_Pastier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marek_pastier/32/84932_2.png) [@Marek\_Pastier](https://discuss.elastic.co/u/Marek_Pastier)
#### Post date: [January 23, 2019, 7:26am UTC](https://discuss.elastic.co/t/filebeat-ignore-harvest-json-file/165163/3 "2019-01-23T07:26:36Z")

</div>

thank you for proposal. But is not working for me. I change filebeat configuration next.

```
filebeat.inputs:

filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /var/log/eset.log
  json.keys_under_root: true
  json.add_error_key: true

```

Now is working. Here is seeting from logstash folder.  
cd /etc/logstash/conf.d/  
ls -l  
02-beats-input.conf  
10-syslog-filter.conf  
15-eset-filter.conf  
30-elasticsearch-output.conf

cat 15-eset-filter.conf

input {  
beats {  
port =\> "5044"  
host =\> "localhost"  
}  
}  
filter {  
json {  
source =\> "message"  
}  
}  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
}  
}

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 20, 2019, 7:34am UTC](https://discuss.elastic.co/t/filebeat-ignore-harvest-json-file/165163/4 "2019-02-20T07:34:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.