# Filebeat is putting whole JSON object into one field

**URL:** https://discuss.elastic.co/t/filebeat-is-putting-whole-json-object-into-one-field/225815
**Category:** Beats
**Tags:** filebeat
**Created:** [March 31, 2020, 8:16am UTC](https://discuss.elastic.co/t/filebeat-is-putting-whole-json-object-into-one-field/225815 "2020-03-31T08:16:52Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Mattness](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattness/32/52975_2.png) [@Mattness](https://discuss.elastic.co/u/Mattness)
#### Post date: [March 31, 2020, 8:16am UTC](https://discuss.elastic.co/t/filebeat-is-putting-whole-json-object-into-one-field/225815/1 "2020-03-31T08:16:52Z")

</div>

Hello,

I am using filebeat to route log data from my machine to Elasticsearch.  
The log-files contain multiple lines with every line being one JSON object literal.

I want each line to become an event with as many fields as there are properties.  
But so far this only works partly. Every JSON object literal becomes an event in the index but then the whole line is just put into one field called "message".

Is this a mapping problem or configuration problem? Can anyone help?

Thanks in advance 🙂

---

<div class="post-metadata">

### Author: ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [March 31, 2020, 8:26am UTC](https://discuss.elastic.co/t/filebeat-is-putting-whole-json-object-into-one-field/225815/2 "2020-03-31T08:26:17Z")

</div>

Hi!

Since you want to handle json logs I would suggest you playing around with the json related features that Filebeat provides:

[https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-config-json](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-config-json)  
[https://www.elastic.co/guide/en/beats/filebeat/current/decode-json-fields.html](https://www.elastic.co/guide/en/beats/filebeat/current/decode-json-fields.html)

Thank you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 28, 2020, 8:26am UTC](https://discuss.elastic.co/t/filebeat-is-putting-whole-json-object-into-one-field/225815/3 "2020-04-28T08:26:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.