# Filebeat not ingesting JSON

**URL:** <https://discuss.elastic.co/t/filebeat-not-ingesting-json/185634>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 13, 2019, 12:06pm UTC](https://discuss.elastic.co/t/filebeat-not-ingesting-json/185634 "2019-06-13T12:06:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Astarandel](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@Astarandel](https://discuss.elastic.co/u/Astarandel)\
**Post date:** [June 13, 2019, 12:06pm UTC](https://discuss.elastic.co/t/filebeat-not-ingesting-json/185634/1 "2019-06-13T12:06:54Z")

</div>

Hi folks,

I've been using Filebeat for ingesting regular log files to Logstash without a problem.

I've tried to ingest some JSON files which I get from memory tracking logs but nothing seems to happen.

Here is what I get from the filebeat logs:

> 2019-06-13T14:59:42.445+0300 INFO log/harvester.go:255 Harvester started for file: C:\Users\lgrancharov\Desktop\vraymemtrack\_20190513115428\_shf\_assets\_CityLayout\_Model\_SinkholeLayout\_v020.json

And then 5 min later:

> 2019-06-13T15:04:47.470+0300 INFO log/harvester.go:280 File is inactive: C:\Users\lgrancharov\Desktop\vraymemtrack\_20190513115428\_shf\_assets\_CityLayout\_Model\_SinkholeLayout\_v020.json. Closing because close\_inactive of 5m0s reached.

Here is the Filebeat config:

```
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - C:\Users\lgrancharov\Desktop\vraymemtrack*.json
  fields:
     source_type: v-ray
     application_name: v-ray_memory_tracking
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: log

```

Any help is appreciated.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 13, 2019, 12:14pm UTC](https://discuss.elastic.co/t/filebeat-not-ingesting-json/185634/2 "2019-06-13T12:14:04Z")

</div>

Is each JSON object on a single line? If not you probably need configure [handling of multiline messages](https://www.elastic.co/guide/en/beats/filebeat/7.1/multiline-examples.html).

---

<div class="post-metadata">

**Author:** ![Astarandel](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@Astarandel](https://discuss.elastic.co/u/Astarandel)\
**Post date:** [June 13, 2019, 12:30pm UTC](https://discuss.elastic.co/t/filebeat-not-ingesting-json/185634/3 "2019-06-13T12:30:22Z")

</div>

The whole file is a single line if that's what you mean.

If I try to use formatting of the sort:

```
{
    "fruit": "Apple",
    "size": "Large",
    "color": "Red"
}

```

I get the following error:

```
|2019-06-13T14:42:21.357+0300|ERROR|json/json.go:51|Error decoding JSON: unexpected EOF|
|---|---|---|---|
|2019-06-13T14:42:21.357+0300|ERROR|json/json.go:51|Error decoding JSON: json: cannot unmarshal string into Go value of type map[string]interface {}|
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2019, 12:30pm UTC](https://discuss.elastic.co/t/filebeat-not-ingesting-json/185634/4 "2019-07-11T12:30:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.