# How to parse message use ELK+Kafka

**URL:** <https://discuss.elastic.co/t/how-to-parse-message-use-elk-kafka/275642>\
**Category:** Logstash\
**Created:** [June 11, 2021, 5:02am UTC](https://discuss.elastic.co/t/how-to-parse-message-use-elk-kafka/275642 "2021-06-11T05:02:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tod-yangyd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tod-yangyd/32/89969_2.png) [@tod-yangyd](https://discuss.elastic.co/u/tod-yangyd)\
**Post date:** [June 11, 2021, 5:02am UTC](https://discuss.elastic.co/t/how-to-parse-message-use-elk-kafka/275642/1 "2021-06-11T05:02:02Z")

</div>

Recently I tried to analyzed the log with the stream：filebeat -\> kafka -\>logstash -\> ES

The data stored in ES becomes the structure shown below：

```auto
{
   “_source”:{
           “@timestamp” : "YYYY-MM-DDTHH:mm:ss.sss"
           "message":""" "@timestamp" : "YYYY-MM-DDTHH:mm:ss.sss", "message": "raw data" """" }
}

```

The "raw data" I actually want to parse is in message:{"message" : " **raw data**"}, which FileBeat didn't have to worry about when sending data directly to Logstash in the past, now that Kafka is added, what do I do?

---

<div class="post-metadata">

**Author:** ![tod-yangyd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tod-yangyd/32/89969_2.png) [@tod-yangyd](https://discuss.elastic.co/u/tod-yangyd)\
**Post date:** [June 11, 2021, 5:52am UTC](https://discuss.elastic.co/t/how-to-parse-message-use-elk-kafka/275642/2 "2021-06-11T05:52:25Z")

</div>

Well, when I add "codec = \>;Json ", the data is correct.....

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2021, 5:52am UTC](https://discuss.elastic.co/t/how-to-parse-message-use-elk-kafka/275642/3 "2021-07-09T05:52:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.