# Filebeat send json format log, kibana can't recognize filed

**URL:** https://discuss.elastic.co/t/filebeat-send-json-format-log-kibana-cant-recognize-filed/171658
**Category:** Beats
**Tags:** filebeat
**Created:** [March 11, 2019, 3:23am UTC](https://discuss.elastic.co/t/filebeat-send-json-format-log-kibana-cant-recognize-filed/171658 "2019-03-11T03:23:50Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![lijin\_liu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lijin_liu/32/41749_2.png) [@lijin\_liu](https://discuss.elastic.co/u/lijin_liu)
#### Post date: [March 11, 2019, 3:23am UTC](https://discuss.elastic.co/t/filebeat-send-json-format-log-kibana-cant-recognize-filed/171658/1 "2019-03-11T03:23:50Z")

</div>

Hello,

I'm new to filebeat/elk. My problem is the Kibana can't recognize the field in my log.

The log content looks(via `less log.log`):

```auto
...
{"@timestamp":"2019-03-11T03:01:53.205+00:00","@version":"1","message":"spread not regression","logger_name":"com.arbitrage.tactics.hedge.FSHedgeTactics","thread_name":"Tactics-Worker","level":"INFO","level_value":20000}
...

```

the filebeat config:

```auto
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /svc/arbitrage/log-logstash/arbitrage.log

output.elasticsearch:
  hosts: ["xxx"]

filebeat.config:
  modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
~

```

After I run filbert/ELK, the logs appeared, as:

 ![59](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f47bd4a9e4215158f709cfd06f18f2e1939bd067.png)

it can't recognize the `logger_name`, `thread_name` ...

Because I'm new in Filebeat/ELK, please don't mind if I post wrong place,

Thanks in advance!

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [March 11, 2019, 2:25pm UTC](https://discuss.elastic.co/t/filebeat-send-json-format-log-kibana-cant-recognize-filed/171658/2 "2019-03-11T14:25:09Z")

</div>

The json log line is not parsed. That's why `logger_name` and `thread_name` are no actual fields. You have to enable json parsing in filebeat: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-config-json](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-config-json)

---

<div class="post-metadata">

### Author: ![lijin\_liu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lijin_liu/32/41749_2.png) [@lijin\_liu](https://discuss.elastic.co/u/lijin_liu)
#### Post date: [March 12, 2019, 11:21am UTC](https://discuss.elastic.co/t/filebeat-send-json-format-log-kibana-cant-recognize-filed/171658/3 "2019-03-12T11:21:27Z")

</div>

Thanks for your help, works like a charm!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 9, 2019, 11:21am UTC](https://discuss.elastic.co/t/filebeat-send-json-format-log-kibana-cant-recognize-filed/171658/4 "2019-04-09T11:21:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.