# Filebeat.yml include\_lines and decode\_json can't work together

**URL:** <https://discuss.elastic.co/t/filebeat-yml-include-lines-and-decode-json-cant-work-together/131385>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 11, 2018, 3:28am UTC](https://discuss.elastic.co/t/filebeat-yml-include-lines-and-decode-json-cant-work-together/131385 "2018-05-11T03:28:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Qing](https://avatars.discourse-cdn.com/v4/letter/q/e99b99/32.png) [@Qing](https://discuss.elastic.co/u/Qing)\
**Post date:** [May 11, 2018, 3:28am UTC](https://discuss.elastic.co/t/filebeat-yml-include-lines-and-decode-json-cant-work-together/131385/1 "2018-05-11T03:28:31Z")

</div>

Hi

Can anyone help me ?  
I meet problem, error info:

```
Exiting: Error in initing prospector: When using the JSON decoder and line filtering together, you need to specify a message_key value accessing 'filebeat.prospectors.0' (source:'filebeat.yml')
Exiting: Error in initing prospector: When using the JSON decoder and line filtering together, you need to specify a message_key value accessing 'filebeat.prospectors.0' (source:'filebeat.yml')

-------------------------------------------filebeat.yml------------------------------------------------------------------
filebeat.prospectors:

- type: log
  enabled: true
  json.keys_under_root: true
  paths:
    - /data/weblog/nginx/nginx.log
	
  # Include lines. A list of regular expressions to match. It exports the lines that are
  # matching any regular expression from the list.
  include_lines: ['/api/datasources/proxy/']

processors:
    - decode_json_fields:
        fields: ["message"]
        target: json
        max_depth: 1

------------------------------------------filebeat debug log---------------------------------------------------------------------------------		
2018-05-11T10:58:43.129+0800	DEBUG	[publish]	pipeline/processor.go:275	Publish event: {
  "@timestamp": "2018-05-11T02:58:43.129Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "doc",
    "version": "6.2.4"
  },
  "source": "/data/weblog/nginx/nginx.log",
  "beat": {
    "version": "6.2.4",
    "name": "8.ops.com",
    "hostname": "8.ops.com"
  },
  "method": "GET",
  "time": "11/May/2018:09:36:17 +0800",
  "cost": "0.010",
  "prospector": {
    "type": "log"
  },
  "body": "",
  "status": "200",
  "uri": "GET /d/000000321/neng?refresh=1m\u0026orgId=43 HTTP/1.1",
  "offset": 1780916
}

```

* * *

ths

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [May 11, 2018, 7:14am UTC](https://discuss.elastic.co/t/filebeat-yml-include-lines-and-decode-json-cant-work-together/131385/2 "2018-05-11T07:14:23Z")

</div>

Can you please explain why you post the same question 3 times?

- [Filebeat.yml include\_lines and decode\_json can't work together](https://discuss.elastic.co/t/filebeat-yml-include-lines-and-decode-json-cant-work-together/131385)
- [Filebeat include\_lines and decode\_json can't work](https://discuss.elastic.co/t/filebeat-include-lines-and-decode-json-cant-work/131383)

Please stop doing that.

---

<div class="post-metadata">

**Author:** ![Qing](https://avatars.discourse-cdn.com/v4/letter/q/e99b99/32.png) [@Qing](https://discuss.elastic.co/u/Qing)\
**Post date:** [May 11, 2018, 7:41am UTC](https://discuss.elastic.co/t/filebeat-yml-include-lines-and-decode-json-cant-work-together/131385/3 "2018-05-11T07:41:00Z")

</div>

I'm so sorry  
I can't delete other two topic.  
I send the first and the second topic which were hiden, I thought them lost.

Can you help me to delete them?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [May 11, 2018, 8:18am UTC](https://discuss.elastic.co/t/filebeat-yml-include-lines-and-decode-json-cant-work-together/131385/4 "2018-05-11T08:18:34Z")

</div>

I prefer not deleting post especially when links exists. Best is that we close the topics as soon as they are answered.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2018, 8:18am UTC](https://discuss.elastic.co/t/filebeat-yml-include-lines-and-decode-json-cant-work-together/131385/5 "2018-06-08T08:18:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.