Filebeat: Payload Format

Elastic Stack Beats
1

Hi,
I'm testing out filebeat on our elastic search logs. However, when the logs hit elasticsearch an "_jsonparsefailure" tag gets added by the beats input in logstash.

Can I ask, what format does beats use for sending to logstash? I'm using the "json" codec atm. Should I be using something else?

Regards,
David

2

Use the plain codec and inspect the events coming in. Unless the events you are reading from logs are in JSON form, which Elasticsearch logs are not, you should not need to use any JSON codec.