# How to Parse Json log format by ConfigMap in Logstash

**URL:** <https://discuss.elastic.co/t/how-to-parse-json-log-format-by-configmap-in-logstash/168438>\
**Category:** Logstash\
**Created:** [February 14, 2019, 3:10pm UTC](https://discuss.elastic.co/t/how-to-parse-json-log-format-by-configmap-in-logstash/168438 "2019-02-14T15:10:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![aleksei.saiko](https://avatars.discourse-cdn.com/v4/letter/a/b9bd4f/32.png) [@aleksei.saiko](https://discuss.elastic.co/u/aleksei.saiko)\
**Post date:** [February 14, 2019, 3:10pm UTC](https://discuss.elastic.co/t/how-to-parse-json-log-format-by-configmap-in-logstash/168438/1 "2019-02-14T15:10:35Z")

</div>

Hi,  
The logs that I'm receiving for message, looking like that in Kibana -

```auto
message {"time_date": "2019-02-14T14:00:39+00:00","client": "10.xxx.xxx.xxx", "host": "xxx.com", "scheme": "https", "request_method": "GET", "request_uri": "/static/img/logo_new.png", "request_id": "xxxxxxxxxxxxxx", "status": 304, "upstream_addr": "xxx.xx.xx.xx:80", "upstream_status": 304, "request_time": 0.002, "upstream_response_time": 0.000, "upstream_connect_time": 0.000, "upstream_header_time": 0.000}

```

My Logstash ConfigFile -

```auto
input {
        beats {
            port => 50XX
        }
    }
    filter {
        if [kubernetes][container][name] == "nginx" {
            grok {
                match => {
                    "message" => "%{IP:remote_ip} - \[%{HTTPDATE:[response][time]}\] \"%{DATA:url}\" %{NUMBER:[response][code]} %{NUMBER:[response][bytes]} %{QS:user_agent}"
                }
                remove_field => "message"
            }
            geoip {
                source => "remote_ip"
                target => "[geoip]"
            }
        }

        date {
            match => ["time", "ISO8601"]
            remove_field => ["time"]
        }
        mutate {
            remove_field => ["source", "host", "[beat][name]", "[beat][version]"]
        }
    }

    output {
            elasticsearch {
                hosts => ["es-xx-01.xxxx.pro:9200", "es-xx-02.xxxx.pro:9200"]
                index => "apps-qa-%{[kubernetes][namespace]}-deployment-%{[kubernetes][pod][name]}-%{[kubernetes][labels][app]}-%{[kubernetes][container][name]}-%{+YYYY.MM.dd}"

        }
    }

```

How can I config the Logstash the right way, to geet the Message log parsed?

Thanks,

Aleksei

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 14, 2019, 3:19pm UTC](https://discuss.elastic.co/t/how-to-parse-json-log-format-by-configmap-in-logstash/168438/2 "2019-02-14T15:19:59Z")

</div>

Use a json filter

```
json { source => "message" }
```

---

<div class="post-metadata">

**Author:** ![aleksei.saiko](https://avatars.discourse-cdn.com/v4/letter/a/b9bd4f/32.png) [@aleksei.saiko](https://discuss.elastic.co/u/aleksei.saiko)\
**Post date:** [February 17, 2019, 10:34am UTC](https://discuss.elastic.co/t/how-to-parse-json-log-format-by-configmap-in-logstash/168438/3 "2019-02-17T10:34:55Z")

</div>

Does it has to be inside the grok, or no inside the grok? Both ways, it didn't work.

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [February 17, 2019, 11:24am UTC](https://discuss.elastic.co/t/how-to-parse-json-log-format-by-configmap-in-logstash/168438/4 "2019-02-17T11:24:42Z")

</div>

This is an basic example of a filter that should produce output. Although it is depending on the if statement, if that matches then the below config should work..

```auto
input {
        beats {
            port => 50XX
        }
    }
    filter {
        if [kubernetes][container][name] == "nginx" {
            json {
                source => "message"
           }
       }
    }

    output {
            elasticsearch {
                hosts => ["es-xx-01.xxxx.pro:9200", "es-xx-02.xxxx.pro:9200"]
                index => "apps-qa-%{[kubernetes][namespace]}-deployment-%{[kubernetes][pod][name]}-%{[kubernetes][labels][app]}-%{[kubernetes][container][name]}-%{+YYYY.MM.dd}"

        }
    }

```

---

<div class="post-metadata">

**Author:** ![aleksei.saiko](https://avatars.discourse-cdn.com/v4/letter/a/b9bd4f/32.png) [@aleksei.saiko](https://discuss.elastic.co/u/aleksei.saiko)\
**Post date:** [February 17, 2019, 2:15pm UTC](https://discuss.elastic.co/t/how-to-parse-json-log-format-by-configmap-in-logstash/168438/5 "2019-02-17T14:15:41Z")

</div>

Thanks, worked

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 17, 2019, 2:15pm UTC](https://discuss.elastic.co/t/how-to-parse-json-log-format-by-configmap-in-logstash/168438/6 "2019-03-17T14:15:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.