# Help in Parsing JSON Log File

**URL:** <https://discuss.elastic.co/t/help-in-parsing-json-log-file/228600>\
**Category:** Logstash\
**Created:** [April 17, 2020, 11:41pm UTC](https://discuss.elastic.co/t/help-in-parsing-json-log-file/228600 "2020-04-17T23:41:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Osama\_Samaan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/osama_samaan/32/66563_2.png) [@Osama\_Samaan](https://discuss.elastic.co/u/Osama_Samaan)\
**Post date:** [April 17, 2020, 11:41pm UTC](https://discuss.elastic.co/t/help-in-parsing-json-log-file/228600/1 "2020-04-17T23:41:29Z")

</div>

Hi,

Please need your help to parse log file contains entries with JSON formated entries , each has the same format as below example :  
{  
"Buffer": {  
"timestamp": "2017-11-03 13:32:55.840817",  
"pcapfile": "file.pcap",  
"packetnumber": 1  
},  
"Ethernet[0]": {  
"ethernet\_dst": "20:e5:2a:b6:93:f1",  
"ethernet\_src": "00:08:02:1c:47:ae",  
"ethernet\_type": 2048  
},  
"IP[1]": {  
"ip\_dst": "10.11.3.1",  
"ip\_flags": 0,  
"ip\_version": 4,  
"ip\_ihl": 5,  
"ip\_id": 4077,  
"ip\_frag": 0,  
"ip\_chksum": 4161,  
"ip\_len": 67,  
"ip\_src": "10.11.3.102",  
"ip\_ttl": 128,  
"ip\_proto": 17,  
"ip\_tos": 0  
},  
"UDP[2]": {  
"udp\_dport": 53,  
"udp\_sport": 53052,  
"udp\_len": 47,  
"udp\_chksum": 63483  
},  
"DNS[3]": {  
"dns\_aa": 0,  
"dns\_qdcount": 1,  
"dns\_ancount": 0,  
"dns\_id": 14310,  
"dns\_nscount": 0,  
"dns\_qr": 0,  
"dns\_rcode": 0,  
"dns\_ra": 0,  
"dns\_rd": 1,  
"dns\_opcode": 0,  
"dns\_tc": 0,  
"dns\_arcount": 0,  
"dns\_z": 0  
},  
"DNS Question Record[4]": {  
"dns\_question\_record\_qname": "[viciouscontroller.com](http://viciouscontroller.com).",  
"dns\_question\_record\_qtype": 1,  
"dns\_question\_record\_qclass": 1  
}  
}

Thanks in advance

---

<div class="post-metadata">

**Author:** ![stcdarrell](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\
**Post date:** [April 18, 2020, 2:33am UTC](https://discuss.elastic.co/t/help-in-parsing-json-log-file/228600/2 "2020-04-18T02:33:46Z")

</div>

this shouldnt be too bad.. you'll have your input .. whether thats filebeat.. or file or whatever.. use the codec =\> json

that will take in the intial json..

after that you'll have some filters for each of the sub-jsons.. which from your example are  
Buffer  
Ethernet  
IP  
UDP  
DNS Question Record..

for each of these (hopefully they are standard in each log)  
you just have a filter:

something like:

filter {  
json {  
source =\> " Buffer"  
}  
}

filter {  
json {  
source =\> "Ethernat[0]"  
}

that should break it all up.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 16, 2020, 2:37am UTC](https://discuss.elastic.co/t/help-in-parsing-json-log-file/228600/3 "2020-05-16T02:37:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.