# Help with json values recieved at kibana
**URL:** https://discuss.elastic.co/t/help-with-json-values-recieved-at-kibana/146647
**Category:** Kibana
**Created:** [August 30, 2018, 8:36am UTC](https://discuss.elastic.co/t/help-with-json-values-recieved-at-kibana/146647 "2018-08-30T08:36:16Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@anon69830709](https://discuss.elastic.co/u/anon69830709)
#### Post date: [August 30, 2018, 8:36am UTC](https://discuss.elastic.co/t/help-with-json-values-recieved-at-kibana/146647/1 "2018-08-30T08:36:16Z")
So i am trying ELK for academic purpose. Now i reached point where kibana is receiving log from other vm's mod-sec logs. But i cannot categories it with ip as not ip filed there.So any can help with the problem.
Here is a sample log
{
"\_index": "filebeat-2018.08.30",
"\_type": "doc",
"\_id": "H2vKiWUB-x2104jz0DvB",
"\_version": 1,
"\_score": null,
"\_source": {
"@version": "1",
"host": {
"name": "debian"
},
"type": "syslog",
"@timestamp": "2018-08-30T07:44:53.759Z",
"message": "[30/Aug/2018:03:44:46 --0400] W4egbn8AAQEAAAkbUBYAAABO 192.168.1.5 50110 192.168.1.12 80",
"input": {
"type": "log"
},
"tags": [
"beats\_input\_codec\_plain\_applied",
"\_grokparsefailure"
],
"beat": {
"version": "6.3.2",
"name": "debian",
"hostname": "debian"
},
"prospector": {
"type": "log"
},
"source": "/var/log/apache2/modsec\_audit.log",
"offset": 64192
},
"fields": {
"@timestamp": [
"2018-08-30T07:44:53.759Z"
]
},
"sort": [
1535615093759
]
}
So here you see the message field contain ip 192.168.1.5.But can i have different filed for ip.?
---
### Author:  [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)
#### Post date: [August 30, 2018, 12:18pm UTC](https://discuss.elastic.co/t/help-with-json-values-recieved-at-kibana/146647/2 "2018-08-30T12:18:18Z")
Hey @anon69830709,
To clarify, are you looking for a way to extract the IP Address from the `message` field?
```json
"message": "[30/Aug/2018:03:44:46 --0400] W4egbn8AAQEAAAkbUBYAAABO 192.168.1.5 50110 192.168.1.12 80"
```
If so, you will need to split that out into its own field before sending the document to Elasticsearch.
How are you sending your logs to Elasticsearch now? Both Beats and Logstash have mechanisms for parsing log files to extract this type of information. I'd recommend asking for help in their discussion boards if you need help getting that setup.
---
### Author:  [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)
#### Post date: [August 31, 2018, 11:24am UTC](https://discuss.elastic.co/t/help-with-json-values-recieved-at-kibana/146647/4 "2018-08-31T11:24:44Z")
Logstash has extensive [documentation](https://www.elastic.co/guide/en/logstash/current/index.html) -- here are some examples for splitting log entries into fields: [https://www.elastic.co/guide/en/logstash/current/config-examples.html](https://www.elastic.co/guide/en/logstash/current/config-examples.html)
You will likely use a grok pattern to split the entries. If so, you can take advantage of the Grok Debugger to test your pattern: [https://www.elastic.co/guide/en/kibana/current/xpack-grokdebugger.html](https://www.elastic.co/guide/en/kibana/current/xpack-grokdebugger.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 29, 2018, 5:02am UTC](https://discuss.elastic.co/t/help-with-json-values-recieved-at-kibana/146647/6 "2018-09-29T05:02:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.