# How to parse json.log using filebeat 6.2

**URL:** https://discuss.elastic.co/t/how-to-parse-json-log-using-filebeat-6-2/186260
**Category:** Beats
**Tags:** filebeat
**Created:** [June 18, 2019, 1:30pm UTC](https://discuss.elastic.co/t/how-to-parse-json-log-using-filebeat-6-2/186260 "2019-06-18T13:30:33Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![prashantgcloud](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@prashantgcloud](https://discuss.elastic.co/u/prashantgcloud)
#### Post date: [June 18, 2019, 1:30pm UTC](https://discuss.elastic.co/t/how-to-parse-json-log-using-filebeat-6-2/186260/1 "2019-06-18T13:30:33Z")

</div>

When I'm setting json.keys\_under\_root: false I'm able to push log in json format to elastic search, but when I set it to true it gives below error:

Private:file.State{Id:"", Finished:false, Fileinfo:(\*os.fileStat)(0xc42038fa00), Source:"/var/lib/docker/containers/6e2f0cc0a99c022d04ef903ac7b08ddfc5fadecfef2b7a0cee4aa64546219af5/6e2f0cc0a99c022d04ef903ac7b08ddfc5fadecfef2b7a0cee4aa64546219af5-json.log", Offset:423166, Timestamp:time.Time{wall:0xbf3a56df1ab01a03, ext:20009288996, loc:(\*time.Location)(0x200d120)}, TTL:-1, Type:"log", FileStateOS:file.StateOS{Inode:0x60e5f, Device:0xca01}}}, Flags:0x1} (status=400): {"type":"mapper\_parsing\_exception","reason":"object mapping for [log] tried to parse field [log] as object, but found a concrete value"}

---

<div class="post-metadata">

### Author: ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [June 19, 2019, 11:55am UTC](https://discuss.elastic.co/t/how-to-parse-json-log-using-filebeat-6-2/186260/2 "2019-06-19T11:55:49Z")

</div>

Hi @prashantgcloud 🙂

Well, the error is clear. Your json is probably something like `{"log":100}` and with the setup you are describing, Filebeat is expecting `{"log":{"key_or_something":100}`

I hope this helps.

---

<div class="post-metadata">

### Author: ![prashantgcloud](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@prashantgcloud](https://discuss.elastic.co/u/prashantgcloud)
#### Post date: [June 25, 2019, 6:28am UTC](https://discuss.elastic.co/t/how-to-parse-json-log-using-filebeat-6-2/186260/3 "2019-06-25T06:28:45Z")

</div>

> [@Mario\_Castro](#):
>
> {"log":100}

How can I parse {"log":100} ?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 23, 2019, 6:28am UTC](https://discuss.elastic.co/t/how-to-parse-json-log-using-filebeat-6-2/186260/4 "2019-07-23T06:28:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.