# Issue : Error decoding JSON: json: cannot unmarshal string into Go value of type map\[string\]interface {}

**URL:** <https://discuss.elastic.co/t/issue-error-decoding-json-json-cannot-unmarshal-string-into-go-value-of-type-map-string-interface/202293>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 4, 2019, 7:15am UTC](https://discuss.elastic.co/t/issue-error-decoding-json-json-cannot-unmarshal-string-into-go-value-of-type-map-string-interface/202293 "2019-10-04T07:15:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![irobot678](https://avatars.discourse-cdn.com/v4/letter/i/54ee81/32.png) [@irobot678](https://discuss.elastic.co/u/irobot678)\
**Post date:** [October 4, 2019, 7:15am UTC](https://discuss.elastic.co/t/issue-error-decoding-json-json-cannot-unmarshal-string-into-go-value-of-type-map-string-interface/202293/1 "2019-10-04T07:15:29Z")

</div>

Hi,

i'm using the elk stack 7.1.1 with x-pack installed and i trying to parse json log into logstash and apply grok filter to it then im getting the following error

> Error decoding JSON: json: cannot unmarshal string into Go value of type map[string]interface {}

I have attached my configurations below please help me understand where i'm doing it wrong.

sample log :

```
{"log":"2019-10-01 07:18:26:854*[DEBUG]*cluster2-nio-worker-0*Connection*userEventTriggered*Connection[cassandraclient/10.3.254.137:9042-1, inFlight=0, closed=false] was inactive for 30 seconds, sending heartbeat\n","stream":"stdout","time":"2019-10-01T07:18:26.85462769Z"}

```

My output :

```auto
{
         "input" => {
        "type" => "log"
    },
           "log" => {
          "file" => {
            "path" => "/home/Desktop/a.log"
        },
        "offset" => 274
    },
      "@version" => "1",
    "@timestamp" => 2019-10-04T06:53:26.046Z,
         "error" => {
           "type" => "json",
        "message" => "Error decoding JSON: json: cannot unmarshal string into Go value of type map[string]interface {}"
    },
          "tags" => [
        [0] "kubelogs",
        [1] "beats_input_raw_event",
        [2] "_grokparsefailure"
    ],filebeat.inputs: 
           "ecs" => {
        "version" => "1.0.0"
    },

```

my filebeat configuration

```auto
filebeat.inputs:

- type: log
  enabled: true
  paths:
    - /home/Desktop/a.log
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: log	
  tags: ["kubelogs"]
 output.logstash:
  hosts: ["localhost:5044"]

```

My logstash configuration

```auto
input {
    beats {
        port => "5044"
    }
}

filter {

       grok {
       match => ["message", '{"log":"%{GREEDYDATA:messagedata}","stream']   
       }
 }

output {
elasticsearch { 
	hosts => ["localhost:9200"] 	
	index => "logstash-%{+YYYY.MM.dd}"
	manage_template => false		
	user => elastic
        password => ##########
	}
stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

**Author:** ![juka](https://avatars.discourse-cdn.com/v4/letter/j/8491ac/32.png) [@juka](https://discuss.elastic.co/u/juka)\
**Post date:** [October 11, 2019, 9:23am UTC](https://discuss.elastic.co/t/issue-error-decoding-json-json-cannot-unmarshal-string-into-go-value-of-type-map-string-interface/202293/2 "2019-10-11T09:23:52Z")

</div>

> [@irobot678](#):
>
> filebeat.inputs: - type: log enabled: true paths: - /home/Desktop/a.log json.keys\_under\_root: true json.add\_error\_key: true json.message\_key: log tags: ["kubelogs"] output.logstash: hosts: ["localhost:5044"]

Hey,  
you should try to add a processor section in your filebeat config for decoding the json data

> **[Filter and enhance the exported data | Filebeat Reference \[7.4\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.4/filtering-and-enhancing-data.html#decode-json-example)**

processors:

- decode\_json\_fields:  
fields: "log"  
overwrite\_keys: true

---

<div class="post-metadata">

**Author:** ![irobot678](https://avatars.discourse-cdn.com/v4/letter/i/54ee81/32.png) [@irobot678](https://discuss.elastic.co/u/irobot678)\
**Post date:** [October 14, 2019, 6:50am UTC](https://discuss.elastic.co/t/issue-error-decoding-json-json-cannot-unmarshal-string-into-go-value-of-type-map-string-interface/202293/3 "2019-10-14T06:50:05Z")

</div>

thanks @juka , it worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 11, 2019, 6:50am UTC](https://discuss.elastic.co/t/issue-error-decoding-json-json-cannot-unmarshal-string-into-go-value-of-type-map-string-interface/202293/4 "2019-11-11T06:50:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.