# Filebeat with json logs, using template

**URL:** https://discuss.elastic.co/t/filebeat-with-json-logs-using-template/200230
**Category:** Beats
**Tags:** filebeat
**Created:** [September 19, 2019, 2:26pm UTC](https://discuss.elastic.co/t/filebeat-with-json-logs-using-template/200230 "2019-09-19T14:26:52Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Frank\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_wang/32/53926_2.png) [@Frank\_Wang](https://discuss.elastic.co/u/Frank_Wang)
#### Post date: [September 19, 2019, 2:26pm UTC](https://discuss.elastic.co/t/filebeat-with-json-logs-using-template/200230/1 "2019-09-19T14:26:52Z")

</div>

Assume I have Logs like:

```auto
{"CFSItemName":"mds list user fs","CFSCluster":"clu01","Item":[{"TotalBytes":9223372036854775808,"FreeBytes":9223372036854763507,"Fsname":"fs-z0gzns5267"},{"TotalBytes":1233372036854775808,"FreeBytes":2132036854763507,"Fsname":"fs-qweasqw17"}]}

```

And I have fields.yml like

```auto
---
key: ecs
title: ECS
description: ECS Fields.
fields:
- name: "@timestamp"
  level: core
  required: true
  type: date
  example: '2016-05-23T08:05:34.853Z'
- name: log.message
  type: text
  level: core
  ignore_above: 0
  required: true
  fields:
  - name: CFSItemName
    type: text
    required: true
  - name: CFSCluster
    type: text
    required: true
  - name: Item
    type: object
    required: true
    fields:
    - name: TotalBytes
      type: long
    - name: FreeBytes
      type: long
    - name: Fsname
      type: text

```

Question is

1. Is my fields.yml [right](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/mapping-types.html)?
2. How should I define my [template](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/indices-put-mapping.html) if logs has different format?

another format is like

```auto
{"CFSItemName":"block manager","CFSCluster":"clu01","Item":[{"BlockTotal": 175125808,"FreeBlock":1763507,"BlockNode":"bk-23aqds5267"},{"BlockTotal": 5635125808,"FreeBlock":2354507,"BlockNode":"bk-ubwed1368"}]}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 17, 2019, 2:27pm UTC](https://discuss.elastic.co/t/filebeat-with-json-logs-using-template/200230/2 "2019-10-17T14:27:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.