# Filebeat - json imports

**URL:** <https://discuss.elastic.co/t/filebeat-json-imports/196568>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 23, 2019, 5:14pm UTC](https://discuss.elastic.co/t/filebeat-json-imports/196568 "2019-08-23T17:14:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![VinceTempera](https://avatars.discourse-cdn.com/v4/letter/v/dbc845/32.png) [@VinceTempera](https://discuss.elastic.co/u/VinceTempera)\
**Post date:** [August 23, 2019, 5:14pm UTC](https://discuss.elastic.co/t/filebeat-json-imports/196568/1 "2019-08-23T17:14:58Z")

</div>

Need some help and hopefully its something simple I have overlooked. I am trying to import a JSON file, single line records and when I go into Kibana, to view the data in discover, I dont see any of the fields if I use a custom index. However, if I use the default (filebeat) format, the fields are displayed. however, if I go into visualizations and create a date table, I see the fields. Here is my filebeat yml file. I only included my changes I made. Everything else is default or commented out.

- type: log

setup.template.settings:  
index.number\_of\_shards: 1  
#index.codec: best\_compression  
#\_source.enabled: true  
setup.ilm.enabled: false

output.elasticsearch:

# Array of hosts to connect to.

```
enabled: true
hosts: ["servername.domain:9200"]
index: "indexname-%{+yyyy.MM.dd}"

```

setup.template.name: "indexname"  
setup.template.pattern: "indexname-\*"

processors:  
#- add\_host\_metadata: ~  
#- add\_cloud\_metadata: ~  
- timestamp:  
field: EventDate  
layouts:  
- '2006-01-02T15:04:05'  
- '2006-01-02T15:04:05.999'  
- drop\_fields:  
fields: EventDate

---

<div class="post-metadata">

**Author:** ![VinceTempera](https://avatars.discourse-cdn.com/v4/letter/v/dbc845/32.png) [@VinceTempera](https://discuss.elastic.co/u/VinceTempera)\
**Post date:** [August 28, 2019, 12:11pm UTC](https://discuss.elastic.co/t/filebeat-json-imports/196568/2 "2019-08-28T12:11:34Z")

</div>

Figured out the problem. Was using the wrong settings. Needed to use the following settings.  
setup.ilm.enabled: auto  
setup.ilm.rollover\_alias: "AliasName"  
setup.ilm.pattern: "{now/d}"

I also created a index policy in Kibana to manage the data.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 25, 2019, 12:12pm UTC](https://discuss.elastic.co/t/filebeat-json-imports/196568/3 "2019-09-25T12:12:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.