# Filebeat : Split the multiline json(array of json object) from message field to separate fields

**URL:** <https://discuss.elastic.co/t/filebeat-split-the-multiline-json-array-of-json-object-from-message-field-to-separate-fields/294134>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 12, 2022, 9:25am UTC](https://discuss.elastic.co/t/filebeat-split-the-multiline-json-array-of-json-object-from-message-field-to-separate-fields/294134 "2022-01-12T09:25:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Magesh\_02](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh_02/32/94023_2.png) [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\
**Post date:** [January 12, 2022, 9:25am UTC](https://discuss.elastic.co/t/filebeat-split-the-multiline-json-array-of-json-object-from-message-field-to-separate-fields/294134/1 "2022-01-12T09:25:34Z")

</div>

I need to use filebeat to push my json data into Elasticsearch, but I'm having trouble decoding my json fields into separate fields extracted from the message field.

Filebeat version : 7.16.2

Filebeat.yml

```
filebeat.inputs:
- type: log
  enabled: true
  paths:
  - /logs/*.json
  multiline.pattern: '^{'
  multiline.negate: true
  multiline.match: after

processors:
  - decode_json_fields:
      fields: ["message"]
      process_array: false
      max_depth: "2"
      target: ""
      overwrite_keys: true
      add_error_key: false

output.elasticsearch:
  # Boolean flag to enable or disable the output module.
  enabled: true
  hosts: ["http://localhost:9200"] 

```

Json Input :

```
{
  "Source": [
    {
      "date": "28-09-2021",
      "language": " C++",
      "comment": 11,
      "code": 150325
    },
    {
      "date": "28-09-2021",
      "language": " C++",
      "comment": 11,
      "code": 106026
    }
  ]
}

```

**Current Output:**

[![enter image description here](https://i.stack.imgur.com/Ldsos.png)](https://i.stack.imgur.com/Ldsos.png)

**Expected Output:**  
separate fields

```
_source: {
@timestamp: "2022-01-12T09:12:36.904Z",
"date": "28-09-2021",
 "language": " C++",
 "comment": 11,
  "code": 106026
input: {
type: "log"
},

```

Please suggest to decode the multiline json in filebeat?

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [January 12, 2022, 1:00pm UTC](https://discuss.elastic.co/t/filebeat-split-the-multiline-json-array-of-json-object-from-message-field-to-separate-fields/294134/2 "2022-01-12T13:00:34Z")

</div>

How about using [json options](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-config-json) right after the multiline ones?

---

<div class="post-metadata">

**Author:** ![Magesh\_02](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh_02/32/94023_2.png) [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\
**Post date:** [January 12, 2022, 1:08pm UTC](https://discuss.elastic.co/t/filebeat-split-the-multiline-json-array-of-json-object-from-message-field-to-separate-fields/294134/3 "2022-01-12T13:08:05Z")

</div>

Hi @ChrsMark

i tried your suggestion, still no effect

> filebeat.inputs:
> 
> - type: log
> 
> json.keys\_under\_root: true
> 
> json.add\_error\_key: true
> 
> json.message\_key: "log"
> 
> processors:
> 
> - decode\_json\_fields:
> 
> output.elasticsearch:
> 
> # Boolean flag to enable or disable the output module.
> 
> enabled: true
> 
> hosts: ["[http://localhost:9200](http://localhost:9200)"]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2022, 3:08pm UTC](https://discuss.elastic.co/t/filebeat-split-the-multiline-json-array-of-json-object-from-message-field-to-separate-fields/294134/4 "2022-02-09T15:08:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.