# How to parse elastic audit.json log file

**URL:** <https://discuss.elastic.co/t/how-to-parse-elastic-audit-json-log-file/338462>\
**Category:** Elastic Observability\
**Tags:** elastic-stack-monitoring\
**Created:** [July 15, 2023, 11:55am UTC](https://discuss.elastic.co/t/how-to-parse-elastic-audit-json-log-file/338462 "2023-07-15T11:55:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ali\_ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ali_ali/32/123473_2.png) [@ali\_ali](https://discuss.elastic.co/u/ali_ali)\
**Post date:** [July 15, 2023, 11:55am UTC](https://discuss.elastic.co/t/how-to-parse-elastic-audit-json-log-file/338462/1 "2023-07-15T11:55:39Z")

</div>

hi  
how to parse elastic audit.json and seperate each field  
i used json plugin but got some bad parsing  
can you send me a filter to parse it.

---

<div class="post-metadata">

**Author:** ![PodarcisMuralis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/podarcismuralis/32/122606_2.png) [@PodarcisMuralis](https://discuss.elastic.co/u/PodarcisMuralis)\
**Post date:** [July 15, 2023, 8:56pm UTC](https://discuss.elastic.co/t/how-to-parse-elastic-audit-json-log-file/338462/2 "2023-07-15T20:56:13Z")

</div>

You may use kv (key-value)plugin?

```auto
filter {
  kv {
    source => "message"
    field_split => ","
    value_split => "="
  }
}

```

or maybe dissect plugin?

```auto
filter {
  dissect {
    mapping => {
      "message" => "%{[@metadata][timestamp]} %{+[@metadata][timestamp]} %{+[@metadata][timestamp]} %{+[@metadata][timestamp]} %{+[@metadata][timestamp]} %{+[@metadata][timestamp]} %{+[@metadata][timestamp]} %{+[@metadata][timestamp]} %{+[@metadata][timestamp]} %{+[@metadata][timestamp]} %{[@metadata][user]} %{[@metadata][action]} %{[@metadata][index]} %{[@metadata][shard]} %{[@metadata][node]} %{[@metadata][reason]} %{[@metadata][state]}"
    }
    remove_field => ["message"]
  }
}

```

---

<div class="post-metadata">

**Author:** ![ali\_ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ali_ali/32/123473_2.png) [@ali\_ali](https://discuss.elastic.co/u/ali_ali)\
**Post date:** [July 16, 2023, 7:00am UTC](https://discuss.elastic.co/t/how-to-parse-elastic-audit-json-log-file/338462/3 "2023-07-16T07:00:26Z")

</div>

hi murat  
i want to remove highlighted fields in the picture

 ![20230716_102146](https://us1.discourse-cdn.com/elastic/original/3X/b/d/bd3ba6a19e189fe95cd3ad22ba62ae230cc5a051.jpeg)

---

<div class="post-metadata">

**Author:** ![ali\_ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ali_ali/32/123473_2.png) [@ali\_ali](https://discuss.elastic.co/u/ali_ali)\
**Post date:** [July 16, 2023, 7:02am UTC](https://discuss.elastic.co/t/how-to-parse-elastic-audit-json-log-file/338462/4 "2023-07-16T07:02:18Z")

</div>

this is my filter

 ![20230716_102253](https://us1.discourse-cdn.com/elastic/original/3X/d/0/d0e03e4c551f558573a88ce015a5a335f9f0d279.jpeg)