Filebeat multiline json

please help, spent more one week and cannot get correct parse settings.
I have file from AWS Athena query, csv, but coverted to pure multiline json. Structure:


    "useridentity":"{type=somevalue={attributes={mfaauthenticated=false, creationdate=2022-05-31T08:04:10Z}, sessionissuer={type=Role, principalid=value, accountid=value, username=value}}}",

{next json with same structure}

I just want to pass this json as is to Elasticsearch. With keys, useridentity, eventtime, eventsource,
eventname etc.
I have tried multiline input,

- type: log
  enabled: true
    - "path/*.json"
  json.keys_under_root: true
  multiline.pattern: '^{'
  multiline.negate: true
  multiline.match:  after
  json.message_key: eventame
  json.overwrite_keys: true
  json.add_error_key: true

and no luck, filebeat just put my json to message field as it.
adding json_decode fields processor just hang filebeat, and it is not processing files
Filebeat version - 7.10
Output configured to file, for now, try to test.
Please, help!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.