Filebeat parsing log containing structured JSON

Running ELK Stack 7.3.2 on Linux

I am trying to parse JSON via FIilebeat then output to Elasticsearch and show individual objects of the structured JSON in Kibana.

Here is test.json
"employee": {
"firstName": "Lokesh",
"lastName": "Gupta",
"website": ""
"employee": {
"firstName": "Brian",
"lastName": "Schultz",
"website": ""

Here is my filebeat.yml

  • type: log

    enabled: true

    • /opt/filebeat-7.3.2-linux-x86_64/logs/test.json

    multiline.pattern: '^{'
    multiline.negate: true
    multiline.match: after


    • decode_json_fields:
      fields: ["employee"]
      max_depth: 3

hosts: ["http://myhost:9200"]

I am not able to parse structured JSON

Hello, do you get an errors when you try to decode your test JSON data? I believe you're on the right track. I was going to suggest using decode_json_fields, but I see it's already in your configuration.

Nothing gets parsed. I tried a one line JSON in the test.json file.

{ "firstName": "Lokesh","lastName": "Gupta" }

No Elastic search index gets created.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.