Hello, I'm looking for help with parsing json data out of a log field. I'm using the elastic agent standalone in Kubernetes and not sure how to configure it for this. I believe the filebeat portion of the elastic agent is indexing the messages. Some of the fields I would like to index as a numeric …

Thanks for the links. Since I was using Elastic Agent, I was able to do it with this processor: processors: - if: regexp: message: "^.*APP-METRIC.*$" then: # Rename fields entry as it seems to conflict with elastic field names - replace: fields: - …

How to parse json from message field

Elastic Stack Beats

jessgarson (Jess Garson) January 11, 2024, 8:13pm 2

Hi, welcome to the community @wrender1.

There are a few similar forum posts on this subject that might be helpful to look at here:

Extracting the JSON fields from the message - #2 by Raed
Parse json in Log field to get individual fields for visualization - #7 by aaron-nimocks
Extracting some JSON fields from the message - #7 by Badger

Best,
Jessica

Topic		Replies	Views
Parse JSON in "message" field Beats filebeat	2	624	April 17, 2021
Parsing Data in message field Elastic Agent	2	463	April 25, 2024
Kubernetes: Filebeat parses JSON in message field no matter if I want or not Beats filebeat	3	460	March 23, 2023
Parse Json data wrapped in "message" into event fields Logstash	6	10725	July 6, 2017
Parsing nested JSON in message field [Logstash][Filebeat] Logstash	1	807	April 9, 2019

How to parse json from message field

Related topics