# Filebeat process with \`logging.json = true\` does not emit pure JSON to stdout

**URL:** https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522
**Category:** Beats
**Tags:** filebeat
**Created:** [December 19, 2017, 11:13pm UTC](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522 "2017-12-19T23:13:46Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![cdaringe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cdaringe/32/25816_2.png) [@cdaringe](https://discuss.elastic.co/u/cdaringe)
#### Post date: [December 19, 2017, 11:13pm UTC](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522/1 "2017-12-19T23:13:46Z")

</div>

Hi all:

I am using filebeat in docker. I use it to send all my containers' logs from /some/docker/dir/\*-json.log to logstash. To make this work simply, I configure all of my services to write single-line, JSON log messages.

However, when setting `logging.json = true` in filebeat.yml, i get:

`2017/12/19 22:39:31.688518 filebeat.go:261: {"level":"WARN","message":"Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.","timestamp":"2017-12-19T22:39:31Z"}`

when I expect a pure JSON string,

`{"level":"WARN","message":"Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.","timestamp":"2017-12-19T22:39:31Z"}`

The first statement is not JSON, it's a string with some JSON contained within.

How can I get filebeat to log pure JSON?

Thanks!

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [December 21, 2017, 1:42am UTC](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522/2 "2017-12-21T01:42:57Z")

</div>

I didn't realize it was previously broken, but it will be fixed in 6.2 because I refactored the logging code. You can test it from a [snapshot build](https://snapshots.elastic.co/summary.html).

---

<div class="post-metadata">

### Author: ![cdaringe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cdaringe/32/25816_2.png) [@cdaringe](https://discuss.elastic.co/u/cdaringe)
#### Post date: [December 27, 2017, 6:18pm UTC](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522/3 "2017-12-27T18:18:23Z")

</div>

awesome, thanks! i'm not in a rush on this change. i'll wait until 6.2.x, assuming that's sometime in the next week or two! 🙂

---

<div class="post-metadata">

### Author: ![joshsleeper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshsleeper/32/26820_2.png) [@joshsleeper](https://discuss.elastic.co/u/joshsleeper)
#### Post date: [January 22, 2018, 7:28pm UTC](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522/4 "2018-01-22T19:28:07Z")

</div>

Hey @andrewkroh,

Do you have a commit (or commits?) to track for this?

Also, did this by chance make it into the 6.1.2 release, or are we definitely waiting for 6.2 to roll?

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [January 22, 2018, 8:51pm UTC](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522/5 "2018-01-22T20:51:15Z")

</div>

This will be released in 6.2. The initial PR was [https://github.com/elastic/beats/pull/590](https://github.com/elastic/beats/pull/590).

---

<div class="post-metadata">

### Author: ![joshsleeper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshsleeper/32/26820_2.png) [@joshsleeper](https://discuss.elastic.co/u/joshsleeper)
#### Post date: [January 22, 2018, 9:20pm UTC](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522/6 "2018-01-22T21:20:24Z")

</div>

Awesome, thanks for the confirmation! 😃

Is there any sort of ETA for the 6.2 releases, or is it still nebulous at this point?

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [January 22, 2018, 9:35pm UTC](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522/7 "2018-01-22T21:35:08Z")

</div>

I think it will be sometime early in February.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 19, 2018, 9:35pm UTC](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522/8 "2018-02-19T21:35:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
