Hello, I'm looking for help with parsing json data out of a log field. I'm using the elastic agent standalone in Kubernetes and not sure how to configure it for this. I believe the filebeat portion of the elastic agent is indexing the messages. Some of the fields I would like to index as a numeric …

Thanks for the links. Since I was using Elastic Agent, I was able to do it with this processor: processors: - if: regexp: message: "^.*APP-METRIC.*$" then: # Rename fields entry as it seems to conflict with elastic field names - replace: fields: - …

Discuss the Elastic Stack

How to parse json from message field

Elastic Stack Beats

jessgarson (Jess Garson) January 11, 2024, 8:13pm 2

Hi, welcome to the community @wrender1.

There are a few similar forum posts on this subject that might be helpful to look at here:

Extracting the JSON fields from the message - #2 by Raed
Parse json in Log field to get individual fields for visualization - #7 by aaron-nimocks
Extracting some JSON fields from the message - #7 by Badger

Best,
Jessica

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.