It looks like you're trying to parse JSON with your grok filter. Use a json filter instead. Although I don't get why that's necessary since the jmx input has codec => json so it should already be decoding the JSON payload. Could you disable your grok filter and just show us the output from the stdout output so that we can see exactly what we're dealing with?