How to parse json.log using filebeat 6.2

[prashantgcloud (Prashant Goel)]

When I'm setting json.keys_under_root: false I'm able to push log in json format to elastic search, but when I set it to true it gives below error:

Private:file.State{Id:"", Finished:false, Fileinfo:(*os.fileStat)(0xc42038fa00), Source:"/var/lib/docker/containers/6e2f0cc0a99c022d04ef903ac7b08ddfc5fadecfef2b7a0cee4aa64546219af5/6e2f0cc0a99c022d04ef903ac7b08ddfc5fadecfef2b7a0cee4aa64546219af5-json.log", Offset:423166, Timestamp:time.Time{wall:0xbf3a56df1ab01a03, ext:20009288996, loc:(*time.Location)(0x200d120)}, TTL:-1, Type:"log", FileStateOS:file.StateOS{Inode:0x60e5f, Device:0xca01}}}, Flags:0x1} (status=400): {"type":"mapper_parsing_exception","reason":"object mapping for [log] tried to parse field [log] as object, but found a concrete value"}

[Mario_Castro]

Hi @prashantgcloud

Well, the error is clear. Your json is probably something like {"log":100} and with the setup you are describing, Filebeat is expecting {"log":{"key_or_something":100}

I hope this helps.

[prashantgcloud (Prashant Goel)]

@Mario_Castro

{"log":100}

How can I parse {"log":100} ?