# Filebeat in kubernetes with json problem

**URL:** <https://discuss.elastic.co/t/filebeat-in-kubernetes-with-json-problem/176716>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 13, 2019, 4:15am UTC](https://discuss.elastic.co/t/filebeat-in-kubernetes-with-json-problem/176716 "2019-04-13T04:15:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![qiyongxiao](https://avatars.discourse-cdn.com/v4/letter/q/7ba0ec/32.png) [@qiyongxiao](https://discuss.elastic.co/u/qiyongxiao)\
**Post date:** [April 13, 2019, 4:15am UTC](https://discuss.elastic.co/t/filebeat-in-kubernetes-with-json-problem/176716/1 "2019-04-13T04:15:35Z")

</div>

Hello, I deployed filebeat on kubernetes. I meet an proble with json on kibana message key. The configmap is  
filebeat.yml: |-  
setup.kibana:  
host: "kibana.kube-system.svc.cluster.local:5601"  
filebeat.inputs:  
- type: docker  
containers.ids: "_"  
containers.paths:  
- /var/lib/docker/containers/{data.kubernetes.pod.uid}/{data.kubernetes.container.name}/_.log  
encoding: utf8  
# exclude\_lines: ['^ERR','^WARN']  
# include\_lines: ['^DBG']  
json.keys\_under\_root: true  
json.overwrite\_keys: true  
json.message\_key: message  
json.add\_error\_key: true  
filebeat.config:  
modules:  
path: /usr/share/filebeat/modules.d/\*.yml  
reload.enabled: true  
reload.period: 5m  
processors:  
# - add\_cloud\_metadata:  
- add\_kubernetes\_metadata:  
in\_cluster: true  
- decode\_json\_fields:  
fields: ["docker"]  
target: json  
- drop\_event:  
when:  
equals:  
kubernetes.namespace: "kube-system"  
- drop\_event:  
when:  
equals:  
stram: "stderr"  
output.elasticsearch:  
hosts: ["[http://elasticsearch.kube-system.svc.cluster.local:9200](http://elasticsearch.kube-system.svc.cluster.local:9200)"]  
index: "${data.kubernetes.container.name}-%{+yyyy.MM.dd}"

On kibana dashboard shows bellow:

 ![dsdsd](https://us1.discourse-cdn.com/elastic/original/3X/f/c/fc94280c929191ceeae6c1a822320a4e9ba64fa9.png)

Could I can get the json fields?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2019, 4:15am UTC](https://discuss.elastic.co/t/filebeat-in-kubernetes-with-json-problem/176716/2 "2019-05-11T04:15:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.