# How to parse json messages in elasticstack
**URL:** https://discuss.elastic.co/t/how-to-parse-json-messages-in-elasticstack/125157
**Category:** Logstash
**Created:** [March 22, 2018, 9:51am UTC](https://discuss.elastic.co/t/how-to-parse-json-messages-in-elasticstack/125157 "2018-03-22T09:51:35Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [March 22, 2018, 9:51am UTC](https://discuss.elastic.co/t/how-to-parse-json-messages-in-elasticstack/125157/1 "2018-03-22T09:51:35Z")
Hi Team,
I am receiving messages in JSON format and wanted to know how do I directly send those in elastic? Can I directly store them in elastic without sending them through logstash or has to route it through logstash?
Here are some
./eve.json:{"timestamp":"2018-03-22T14:49:40.014495+0530","flow\_id":1201901318977695,"in\_iface":"eno16777736","event\_type":"alert","src\_ip":"192.168.1.9","src\_port":65416,"dest\_ip":"192.168.1.42","dest\_port":53,"proto":"UDP","alert":{"action":"allowed","gid":1,"signature\_id":5700011,"rev":1,"signature":"CleanDNS\_Phase1: Malicious domain 57g7spgrzlojinas.onion","category":"","severity":3},"app\_proto":"dns","flow":{"pkts\_toserver":1,"pkts\_toclient":0,"bytes\_toserver":82,"bytes\_toclient":0,"start":"2018-03-22T14:49:40.014495+0530"}}
./eve.json:{"timestamp":"2018-03-22T14:49:40.014495+0530","flow\_id":1201901318977695,"in\_iface":"eno16777736","event\_type":"dns","src\_ip":"192.168.1.9","src\_port":65416,"dest\_ip":"192.168.1.42","dest\_port":53,"proto":"UDP","dns":{"type":"query","id":35,"rrname":"57g7spgrzlojinas.onion","rrtype":"A","tx\_id":0}}
./eve.json:{"timestamp":"2018-03-22T14:49:40.014710+0530","flow\_id":1201901318977695,"in\_iface":"eno16777736","event\_type":"dns","src\_ip":"192.168.1.42","src\_port":53,"dest\_ip":"192.168.1.9","dest\_port":65416,"proto":"UDP","dns":{"type":"answer","id":35,"rcode":"NXDOMAIN","rrname":"57g7spgrzlojinas.onion"}}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 22, 2018, 10:23am UTC](https://discuss.elastic.co/t/how-to-parse-json-messages-in-elasticstack/125157/2 "2018-03-22T10:23:13Z")
You can store them yourself if you like, just use the Elasticsearch's REST API. You can also use Logstash. Your call.
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [March 22, 2018, 6:14pm UTC](https://discuss.elastic.co/t/how-to-parse-json-messages-in-elasticstack/125157/3 "2018-03-22T18:14:03Z")
What I mean here is, do I need to write parsers to ingest json based data like any other text data? or can directly be ingested and elasticsearch will understand fields and mappings?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 22, 2018, 6:45pm UTC](https://discuss.elastic.co/t/how-to-parse-json-messages-in-elasticstack/125157/4 "2018-03-22T18:45:59Z")
Elasticsearch is a JSON document database so it understands JSON perfectly well. No pre-parsing is necessary.
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [March 23, 2018, 3:10am UTC](https://discuss.elastic.co/t/how-to-parse-json-messages-in-elasticstack/125157/5 "2018-03-23T03:10:09Z")
awesome!! that is what I wanted to know. Thanks!!
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [March 23, 2018, 4:35am UTC](https://discuss.elastic.co/t/how-to-parse-json-messages-in-elasticstack/125157/6 "2018-03-23T04:35:39Z")
I believe sending logs through filebeat would be much easier since the file is growing consistently and I need a logs in real-time. what say?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 23, 2018, 8:00pm UTC](https://discuss.elastic.co/t/how-to-parse-json-messages-in-elasticstack/125157/7 "2018-03-23T20:00:22Z")
Sure, although Logstash provides the same functionality.
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [March 24, 2018, 3:00am UTC](https://discuss.elastic.co/t/how-to-parse-json-messages-in-elasticstack/125157/8 "2018-03-24T03:00:20Z")
Yeah thanks I was able to achieve that. Thanks for the support
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 21, 2018, 3:00am UTC](https://discuss.elastic.co/t/how-to-parse-json-messages-in-elasticstack/125157/9 "2018-04-21T03:00:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.