# Filebeat with JSON logs

**URL:** <https://discuss.elastic.co/t/filebeat-with-json-logs/58556>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 22, 2016, 8:13am UTC](https://discuss.elastic.co/t/filebeat-with-json-logs/58556 "2016-08-22T08:13:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Douglas\_Ribas](https://avatars.discourse-cdn.com/v4/letter/d/22d042/32.png) [@Douglas\_Ribas](https://discuss.elastic.co/u/Douglas_Ribas)\
**Post date:** [August 22, 2016, 8:13am UTC](https://discuss.elastic.co/t/filebeat-with-json-logs/58556/1 "2016-08-22T08:13:00Z")

</div>

Hi people.  
I have this situation, all import dates stay in message space  
I have logs in format JSON line by line  
`{'date':'2016-08-22','time':'04:42:59', 'user':'joana','busca':'uol.com','servidor':'Node-03'} {'date':'2016-08-22','time':'04:42:59', 'user':'rafisa','busca':'aol.com.br','servidor':'Node-02'} {'date':'2016-08-22','time':'04:42:59', 'user':'roberto','busca':'palmeiras.com.br','servidor':'Node-01'} {'date':'2016-08-22','time':'04:42:59', 'user':'joana','busca':'google.com','servidor':'Node-03'}`  
And i use kibana to see all date from elasticsearch and my result is:

`@timestamp:August 22nd 2016, 04:43:50.984, 22nd/08beat.hostname:douglas-Inspiron-5548beat.name:douglas-Inspiron-5548count:1fields: - input_type:logmessage:{'date':'2016-08-22','time':'04:42:58', 'user':'wagner','busca':'angelica.globo.com','servidor':'Node-01'}offset:22,339,929source:/opt/logs/cadvlanview/vips.logtype:object_id:AVaxNQESVeR5vHPNwmXN_type:object_index:cadvlanview-2016.08.22_score:`

my elastic maping is:

`{ "cadvlanview-2016.08.22": { "mappings": { "object": { "properties": { "@timestamp": { "type": "date", "format": "strict_date_optional_time||epoch_millis" }, "beat": { "properties": { "hostname": { "type": "string" }, "name": { "type": "string" } } }, "count": { "type": "long" }, "input_type": { "type": "string" }, "message": { "type": "string" }, "offset": { "type": "long" }, "source": { "type": "string" }, "type": { "type": "string" } } } } } }`

how i do mapping menssage text to json format?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 22, 2016, 8:25am UTC](https://discuss.elastic.co/t/filebeat-with-json-logs/58556/2 "2016-08-22T08:25:56Z")

</div>

Filebeat 5 supports parsing JSON logs. Otherwise you need to pipe things through Logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 12, 2016, 8:13am UTC](https://discuss.elastic.co/t/filebeat-with-json-logs/58556/3 "2016-09-12T08:13:01Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.