# How can I expose new fields sourced from the log record?

**URL:** <https://discuss.elastic.co/t/how-can-i-expose-new-fields-sourced-from-the-log-record/62871>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 12, 2016, 10:30pm UTC](https://discuss.elastic.co/t/how-can-i-expose-new-fields-sourced-from-the-log-record/62871 "2016-10-12T22:30:49Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 12, 2016, 10:53pm UTC](https://discuss.elastic.co/t/how-can-i-expose-new-fields-sourced-from-the-log-record/62871/2 "2016-10-12T22:53:14Z")

</div>

It is possible to parse the JSON messages in Filebeat 5.x, but not in Filebeat 1.x. A [`json`](https://www.elastic.co/guide/en/beats/filebeat/5.0/configuration-filebeat-options.html#config-json) option can be specified in the configuration file.

If you are limited to using Filebeat 1.x, then you would need to Logstash to parse the JSON data from the `message` field. You would configure Filebeat -\> Logstash -\> Elasticsearch.

Filebeat 5.x configuration:

```
filebeat:
  prospectors:
    - paths:
        - /var/log/app.log
      json.message_key: msg
      json.keys_under_root: true
      json.add_error_key: true

output:
  console:
    pretty: true
```

---

_[View the full topic](https://discuss.elastic.co/t/how-can-i-expose-new-fields-sourced-from-the-log-record/62871)._