# Filter JSON message in kibana

**URL:** <https://discuss.elastic.co/t/filter-json-message-in-kibana/312535>\
**Category:** Kibana\
**Created:** [August 21, 2022, 2:06am UTC](https://discuss.elastic.co/t/filter-json-message-in-kibana/312535 "2022-08-21T02:06:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![imkinnu](https://avatars.discourse-cdn.com/v4/letter/i/278dde/32.png) [@imkinnu](https://discuss.elastic.co/u/imkinnu)\
**Post date:** [August 21, 2022, 2:06am UTC](https://discuss.elastic.co/t/filter-json-message-in-kibana/312535/1 "2022-08-21T02:06:04Z")

</div>

Hi,  
My JSON file looks like this. I want a filter on Kibana for the JSON object I am passing through logstash. For example

```auto
{
  "_index": "mule-logs",
  "_type": "_doc",
  "_id": "S_gavoIBvzaqpVvKmITM",
  "_score": 1,
  "_source": {
    "message": "{a=1, b=2, type=error}",
    "@version": "1",
    "threadId": 43,
    "host": "127.0.0.1",
    "threadPriority": 5,
    "instant": {
      "nanoOfSecond": 223331800,
      "epochSecond": 1661046790
    },
    "loggerFqcn": "org.apache.logging.slf4j.Log4jLogger",
    "loggerName": "org.mule.runtime.core.internal.processor.LoggerMessageProcessor",
    "port": 64719,
    "level": "INFO",
    "@timestamp": "2022-08-21T01:53:10.223Z",
    "thread": "[MuleRuntime].uber.01: [test].testFlow12.CPU_LITE @29903cf9",
    "endOfBatch": true
  },
  "fields": {
    "loggerFqcn": [
      "org.apache.logging.slf4j.Log4jLogger"
    ],
    "loggerFqcn.keyword": [
      "org.apache.logging.slf4j.Log4jLogger"
    ],
    "level": [
      "INFO"
    ],
    "instant.epochSecond": [
      1661046790
    ],
    "endOfBatch": [
      true
    ],
    "@version.keyword": [
      "1"
    ],
    "loggerName.keyword": [
      "org.mule.runtime.core.internal.processor.LoggerMessageProcessor"
    ],
    "thread": [
      "[MuleRuntime].uber.01: [test].testFlow12.CPU_LITE @29903cf9"
    ],
    "threadPriority": [
      5
    ],
    "message": [
      "{a=1, b=2, type=error}"
    ],
    "thread.keyword": [
      "[MuleRuntime].uber.01: [test].testFlow12.CPU_LITE @29903cf9"
    ],
    "threadId": [
      43
    ],
    "instant.nanoOfSecond": [
      223331800
    ],
    "@timestamp": [
      "2022-08-21T01:53:10.223Z"
    ],
    "level.keyword": [
      "INFO"
    ],
    "port": [
      64719
    ],
    "message.keyword": [
      "{a=1, b=2, type=error}"
    ],
    "host": [
      "127.0.0.1"
    ],
    "@version": [
      "1"
    ],
    "host.keyword": [
      "127.0.0.1"
    ],
    "loggerName": [
      "org.mule.runtime.core.internal.processor.LoggerMessageProcessor"
    ]
  }
}

```

In the above JSON object I want to filter message.type = "error" and message.type = "success".

Currently I am using the below configuration in logstash.

```auto
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  tcp {
    port => 4560
    codec => json
  }
}
filter {   
  date {
    match => ["timeMillis", "UNIX_MS"]
  }
}
output {
	elasticsearch {
		hosts => ["localhost:9200"]
		index => "mule-logs"	
	}	
}

```

---

<div class="post-metadata">

**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Post date:** [September 6, 2022, 9:41am UTC](https://discuss.elastic.co/t/filter-json-message-in-kibana/312535/2 "2022-09-06T09:41:16Z")

</div>

You need to parse your `message` field into an actual object using the Logstash JSON filter:

> **[JSON filter plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html)**

> This is a JSON parsing filter. It takes an existing field which contains JSON and expands it into an actual data structure within the Logstash event.

Once the object is correctly parsed and with the appropriate mapping previously set up for your index, all content should be accessible from Kibana.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2022, 9:41am UTC](https://discuss.elastic.co/t/filter-json-message-in-kibana/312535/3 "2022-10-04T09:41:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.