# Filebeat multiline json

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-json/306287>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 3, 2022, 6:03am UTC](https://discuss.elastic.co/t/filebeat-multiline-json/306287 "2022-06-03T06:03:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Panda\_Free](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/panda_free/32/99176_2.png) [@Panda\_Free](https://discuss.elastic.co/u/Panda_Free)\
**Post date:** [June 3, 2022, 6:03am UTC](https://discuss.elastic.co/t/filebeat-multiline-json/306287/1 "2022-06-03T06:03:28Z")

</div>

Hi,  
please help, spent more one week and cannot get correct parse settings.  
I have file from AWS Athena query, csv, but coverted to pure multiline json. Structure:

```auto
[{

    "useridentity":"{type=somevalue={attributes={mfaauthenticated=false, creationdate=2022-05-31T08:04:10Z}, sessionissuer={type=Role, principalid=value, accountid=value, username=value}}}",
    "eventtime":"time",
    "eventsource":"*.amazonaws.com",
    "eventname":"somename",
    "sourceipaddress":"ip",
    "useragent":"agent",
    "errorcode":"",
    "errormessage":"",
    "requestparameters":"{\"key\":\"value\",\"key\":{\"value\":[{\"value"}]}},{\"somekey\":\"value\",\"somekey\":{\"values\":\"\",\"type\":\"\",\"tTL\":300,\"\":[{\"value\":\"\"}]}}]}}"

}, 
{next json with same structure}
]

```

I just want to pass this json as is to Elasticsearch. With keys, useridentity, eventtime, eventsource,  
eventname etc.  
I have tried multiline input,

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - "path/*.json"
  json.keys_under_root: true
  multiline.pattern: '^{'
  multiline.negate: true
  multiline.match: after
  json.message_key: eventame
  json.overwrite_keys: true
  json.add_error_key: true
 

```

and no luck, filebeat just put my json to message field as it.  
adding json\_decode fields processor just hang filebeat, and it is not processing files  
Filebeat version - 7.10  
Output configured to file, for now, try to test.  
Please, help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2022, 8:04am UTC](https://discuss.elastic.co/t/filebeat-multiline-json/306287/2 "2022-07-01T08:04:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.