JSON file -> Filebeat -> Logstash

Hi, I'm trying to parse a JSON file with Filebeat and then send it to Logstash, Logstash is not receiving data then there is no an output file, these are my configs.yml:

filebeat.yml

filebeat.inputs:
  - type: log

    enabled: true
    include_lines: ["ip_ip"]

    paths:
      - /input_path/output.json
    json.keys_under_root: true
    json.message_key: true

output.logstash:
  hosts: ["localhost:5044"]
  enabled: true

first-pipeline.conf

    input {
      beats {
    	port => "5044"	
      }
    }
    output {
      file{
        path => "output_path/output.json"
      }
    }

Thank you.

What do the filebeat and logstash logs contain? If there are no errors try increasing the log level in filebeat to debug.

Logstash log:

[2020-10-01T16:55:56,547][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.9.2", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc IBM J9 VM 2.9 on 8.0.6.0 - pxa6480sr6-20191107_01(SR6) +indy +jit [linux-x86_64]"}
[2020-10-01T16:55:56,969][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-10-01T16:55:58,202][INFO ][org.reflections.Reflections] Reflections took 40 ms to scan 1 urls, producing 22 keys and 45 values
[2020-10-01T16:55:58,741][INFO ][logstash.javapipeline ][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/usr/share/logstash/first-pipeline.conf"], :thread=>"#<Thread:0x327382fe run>"}
[2020-10-01T16:55:59,522][INFO ][logstash.javapipeline ][main] Pipeline Java execution initialization time {"seconds"=>0.77}
[2020-10-01T16:55:59,541][INFO ][logstash.inputs.beats ][main] Beats inputs: Starting input listener {:address=>"0.0.0.0:5044"}
[2020-10-01T16:55:59,555][INFO ][logstash.javapipeline ][main] Pipeline started {"pipeline.id"=>"main"}
[2020-10-01T16:55:59,701][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>}
[2020-10-01T16:55:59,722][INFO ][org.logstash.beats.Server][main][4dc0dee64e2348cb558550456efb278f18c4ef4270e7608ecfef7557dd307ab5] Starting server on port: 5044
[2020-10-01T16:56:00,087][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2020-10-01T16:57:22,880][WARN ][logstash.runner ] SIGINT received. Shutting down.
[2020-10-01T16:57:27,962][WARN ][logstash.runner ] Received shutdown signal, but pipeline is still waiting for in-flight events
to be processed. Sending another ^C will force quit Logstash, but this may cause
data loss.
[2020-10-01T16:57:31,183][INFO ][logstash.javapipeline ] Pipeline terminated {"pipeline.id"=>"main"}
[2020-10-01T16:57:31,225][INFO ][logstash.runner ] Logstash shut down.

Filebeat log:

2020-10-01T17:02:36.355+0200 INFO instance/beat.go:640 Home path: [/home/anthony/beats/filebeat-7.9.2-linux-x86_64] Config path: [/home/anthony/beats/filebeat-7.9.2-linux-x86_64] Data path: [/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data] Logs path: [/home/anthony/beats/filebeat-7.9.2-linux-x86_64/logs]
2020-10-01T17:02:36.355+0200 DEBUG [beat] instance/beat.go:692 Beat metadata path: /home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/meta.json
2020-10-01T17:02:36.355+0200 INFO instance/beat.go:648 Beat ID: 9d5480c8-0124-41fa-8336-d5730f03b601
2020-10-01T17:02:36.356+0200 DEBUG [seccomp] seccomp/seccomp.go:117 Loading syscall filter {"seccomp_filter": {"no_new_privs":true,"flag":"tsync","policy":{"default_action":"errno","syscalls":[{"names":["accept","accept4","access","arch_prctl","bind","brk","chmod","chown","clock_gettime","clone","close","connect","dup","dup2","epoll_create","epoll_create1","epoll_ctl","epoll_pwait","epoll_wait","exit","exit_group","fchdir","fchmod","fchmodat","fchown","fchownat","fcntl","fdatasync","flock","fstat","fstatfs","fsync","ftruncate","futex","getcwd","getdents","getdents64","geteuid","getgid","getpeername","getpid","getppid","getrandom","getrlimit","getrusage","getsockname","getsockopt","gettid","gettimeofday","getuid","inotify_add_watch","inotify_init1","inotify_rm_watch","ioctl","kill","listen","lseek","lstat","madvise","mincore","mkdirat","mmap","mprotect","munmap","nanosleep","newfstatat","open","openat","pipe","pipe2","poll","ppoll","pread64","pselect6","pwrite64","read","readlink","readlinkat","recvfrom","recvmmsg","recvmsg","rename","renameat","rt_sigaction","rt_sigprocmask","rt_sigreturn","sched_getaffinity","sched_yield","sendfile","sendmmsg","sendmsg","sendto","set_robust_list","setitimer","setsockopt","shutdown","sigaltstack","socket","splice","stat","statfs","sysinfo","tgkill","time","tkill","uname","unlink","unlinkat","wait4","waitid","write","writev"],"action":"allow"}]}}}
2020-10-01T17:02:36.356+0200 INFO [seccomp] seccomp/seccomp.go:124 Syscall filter successfully installed
2020-10-01T17:02:36.356+0200 INFO [beat] instance/beat.go:976 Beat info {"system_info": {"beat": {"path": {"config": "/home/anthony/beats/filebeat-7.9.2-linux-x86_64", "data": "/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data", "home": "/home/anthony/beats/filebeat-7.9.2-linux-x86_64", "logs": "/home/anthony/beats/filebeat-7.9.2-linux-x86_64/logs"}, "type": "filebeat", "uuid": "9d5480c8-0124-41fa-8336-d5730f03b601"}}}
2020-10-01T17:02:36.356+0200 INFO [beat] instance/beat.go:985 Build info {"system_info": {"build": {"commit": "2ab907f5ccecf9fd82fe37105082e89fd871f684", "libbeat": "7.9.2", "time": "2020-09-22T23:19:45.000Z", "version": "7.9.2"}}}
2020-10-01T17:02:36.356+0200 INFO [beat] instance/beat.go:988 Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":4,"version":"go1.14.7"}}}
2020-10-01T17:02:36.357+0200 INFO [beat] instance/beat.go:992 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2020-10-01T10:53:06+02:00","containerized":false,"name":"Anthony-HP-Pavilion-Notebook","ip":["127.0.0.1/8","::1/128","10.182.107.109/16","fe80::371f:84e8:e0c7:39ee/64","172.17.0.1/16"],"kernel_version":"4.15.0-20-generic","mac":["80:ce:62:45:e6:d7","00:23:15:ec:d3:58","02:42:fa:9c:8f:ac"],"os":{"family":"","platform":"linuxmint","name":"Linux Mint","version":"19.1 (Tessa)","major":19,"minor":1,"patch":0,"codename":"tessa"},"timezone":"CEST","timezone_offset_sec":7200,"id":"82929df7ee394b73b81252fe3b4e5020"}}}
2020-10-01T17:02:36.357+0200 INFO [beat] instance/beat.go:1021 Process info {"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read"],"ambient":null}, "cwd": "/home/anthony/beats/filebeat-7.9.2-linux-x86_64", "exe": "/home/anthony/beats/filebeat-7.9.2-linux-x86_64/filebeat", "name": "filebeat", "pid": 9882, "ppid": 9881, "seccomp": {"mode":"filter","no_new_privs":true}, "start_time": "2020-10-01T17:02:35.540+0200"}}}
2020-10-01T17:02:36.357+0200 INFO instance/beat.go:299 Setup Beat: filebeat; Version: 7.9.2
2020-10-01T17:02:36.357+0200 DEBUG [beat] instance/beat.go:325 Initializing output plugins
2020-10-01T17:02:36.357+0200 DEBUG [publisher] pipeline/consumer.go:148 start pipeline event consumer
2020-10-01T17:02:36.357+0200 INFO [publisher] pipeline/module.go:113 Beat name: Anthony-HP-Pavilion-Notebook
2020-10-01T17:02:36.358+0200 WARN beater/filebeat.go:178 Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
2020-10-01T17:02:36.359+0200 INFO [monitoring] log/log.go:118 Starting metrics logging every 30s
2020-10-01T17:02:36.359+0200 INFO instance/beat.go:450 filebeat start running.
2020-10-01T17:02:36.359+0200 DEBUG [test] registrar/migrate.go:304 isFile(/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry) -> false
2020-10-01T17:02:36.359+0200 DEBUG [test] registrar/migrate.go:304 isFile() -> false
2020-10-01T17:02:36.359+0200 DEBUG [test] registrar/migrate.go:297 isDir(/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry/filebeat) -> true
2020-10-01T17:02:36.359+0200 DEBUG [test] registrar/migrate.go:304 isFile(/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry/filebeat/meta.json) -> true
2020-10-01T17:02:36.359+0200 DEBUG [registrar] registrar/migrate.go:84 Registry type '1' found
2020-10-01T17:02:36.359+0200 INFO memlog/store.go:119 Loading data file of '/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry/filebeat' succeeded. Active transaction id=0
2020-10-01T17:02:36.359+0200 INFO memlog/store.go:124 Finished loading transaction log file for '/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry/filebeat'. Active transaction id=12
2020-10-01T17:02:36.359+0200 WARN beater/filebeat.go:381 Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
2020-10-01T17:02:36.359+0200 INFO [registrar] registrar/registrar.go:109 States Loaded from registrar: 1
2020-10-01T17:02:36.359+0200 INFO [crawler] beater/crawler.go:71 Loading Inputs: 1
2020-10-01T17:02:36.360+0200 DEBUG [registrar] registrar/registrar.go:140 Starting Registrar
2020-10-01T17:02:36.360+0200 DEBUG [input] log/config.go:207 recursive glob enabled
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:169 exclude_files: . Number of states: 1
2020-10-01T17:02:36.360+0200 DEBUG [input] file/states.go:68 New state added for /home/anthony/TFG/archivos/packs.json
2020-10-01T17:02:36.360+0200 DEBUG [acker] beater/acker.go:59 stateful ack {"count": 1}
2020-10-01T17:02:36.360+0200 DEBUG [publisher] pipeline/client.go:221 Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16913446-51 PrevId: Finished:true Fileinfo: Source:/home/anthony/TFG/archivos/packs.json Offset:29163 Timestamp:2020-10-01 16:56:03.272087794 +0200 CEST TTL:-1ns Type:log Meta:map FileStateOS:16913446-51 IdentifierName:native} TimeSeries:false}
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:199 input with previous states loaded: 1
2020-10-01T17:02:36.360+0200 INFO log/input.go:157 Configured paths: [/home/anthony/TFG/archivos/packs.json]
2020-10-01T17:02:36.360+0200 DEBUG [registrar] registrar/registrar.go:264 Processing 1 events
2020-10-01T17:02:36.360+0200 INFO [crawler] beater/crawler.go:141 Starting input (ID: 3115676435086966116)
2020-10-01T17:02:36.360+0200 DEBUG [registrar] registrar/registrar.go:231 Registrar state updates processed. Count: 1
2020-10-01T17:02:36.360+0200 DEBUG [registrar] registrar/registrar.go:254 Registrar states cleaned up. Before: 1, After: 1, Pending: 0
2020-10-01T17:02:36.360+0200 DEBUG [registrar] registrar/registrar.go:201 Registry file updated. 1 active states.
2020-10-01T17:02:36.360+0200 INFO [crawler] beater/crawler.go:108 Loading and starting Inputs completed. Enabled inputs: 1
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:205 Start next scan
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:439 Check file for harvesting: /home/anthony/TFG/archivos/packs.json
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:530 Update existing file for harvesting: /home/anthony/TFG/archivos/packs.json, offset: 29163
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:584 File didn't change: /home/anthony/TFG/archivos/packs.json
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:226 input states cleaned up. Before: 1, After: 1, Pending: 0

If I am reading that correctly, then it thinks it has previously read 29163 bytes from archivos/packs.json and the current file size is 29163, so there is no new data.

The fact that it has already read the file is recorded in the registry

/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry/filebeat/meta.json

Stop filebeat, move that file somewhere else, then start filebeat again. See if it re-reads the file.

Thank you for reply.
I tried that and i got this:

2020-10-06T12:38:49.584+0200	INFO	instance/beat.go:648	Beat ID: 5a2c132e-5bd3-4710-8048-dc7d7c5adc92
2020-10-06T12:38:49.585+0200	INFO	[seccomp]	seccomp/seccomp.go:124	Syscall filter successfully installed
2020-10-06T12:38:49.585+0200	INFO	[beat]	instance/beat.go:985	Build info	{"system_info": {"build": {"commit": "2ab907f5ccecf9fd82fe37105082e89fd871f684", "libbeat": "7.9.2", "time": "2020-09-22T23:19:45.000Z", "version": "7.9.2"}}}
2020-10-06T12:38:49.585+0200	INFO	[beat]	instance/beat.go:988	Go runtime info	{"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":4,"version":"go1.14.7"}}}
2020-10-06T12:38:49.586+0200	INFO	instance/beat.go:299	Setup Beat: filebeat; Version: 7.9.2
2020-10-06T12:38:49.586+0200	DEBUG	[beat]	instance/beat.go:325	Initializing output plugins
2020-10-06T12:38:49.587+0200	DEBUG	[publisher]	pipeline/consumer.go:148	start pipeline event consumer
2020-10-06T12:38:49.587+0200	INFO	[publisher]	pipeline/module.go:113	Beat name: Anthony-HP-Pavilion-Notebook
2020-10-06T12:38:49.588+0200	WARN	beater/filebeat.go:178	Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
2020-10-06T12:38:49.588+0200	INFO	instance/beat.go:450	filebeat start running.
2020-10-06T12:38:49.588+0200	DEBUG	[test]	registrar/migrate.go:304	isFile(/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry) -> false
2020-10-06T12:38:49.588+0200	DEBUG	[test]	registrar/migrate.go:304	isFile() -> false
2020-10-06T12:38:49.588+0200	DEBUG	[test]	registrar/migrate.go:297	isDir(/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry/filebeat) -> false
2020-10-06T12:38:49.588+0200	DEBUG	[registrar]	registrar/migrate.go:84	Registry type '' found
2020-10-06T12:38:49.588+0200	DEBUG	[test]	registrar/migrate.go:304	isFile(.bak) -> false
2020-10-06T12:38:49.588+0200	INFO	[monitoring]	log/log.go:118	Starting metrics logging every 30s
2020-10-06T12:38:49.722+0200	INFO	memlog/store.go:119	Loading data file of '/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry/filebeat' succeeded. Active transaction id=0
2020-10-06T12:38:49.722+0200	INFO	memlog/store.go:124	Finished loading transaction log file for '/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry/filebeat'. Active transaction id=0
2020-10-06T12:38:49.722+0200	WARN	beater/filebeat.go:381	Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
2020-10-06T12:38:49.722+0200	INFO	[registrar]	registrar/registrar.go:109	States Loaded from registrar: 0
2020-10-06T12:38:49.722+0200	INFO	[crawler]	beater/crawler.go:71	Loading Inputs: 1
2020-10-06T12:38:49.722+0200	DEBUG	[registrar]	registrar/registrar.go:140	Starting Registrar
2020-10-06T12:38:49.722+0200	DEBUG	[input]	log/config.go:207	recursive glob enabled
2020-10-06T12:38:49.722+0200	DEBUG	[input]	log/input.go:169	exclude_files: []. Number of states: 0
2020-10-06T12:38:49.722+0200	DEBUG	[input]	log/input.go:199	input with previous states loaded: 0
2020-10-06T12:38:49.723+0200	INFO	log/input.go:157	Configured paths: [/home/anthony/TFG/archivos/twomore/packs.json]
2020-10-06T12:38:49.723+0200	INFO	[crawler]	beater/crawler.go:141	Starting input (ID: 9329501670631896042)
2020-10-06T12:38:49.723+0200	INFO	[crawler]	beater/crawler.go:108	Loading and starting Inputs completed. Enabled inputs: 1
2020-10-06T12:38:49.723+0200	DEBUG	[input]	log/input.go:205	Start next scan
2020-10-06T12:38:49.723+0200	DEBUG	[input]	log/input.go:439	Check file for harvesting: /home/anthony/TFG/archivos/twomore/packs.json
2020-10-06T12:38:49.723+0200	DEBUG	[input]	log/input.go:512	Start harvester for new file: /home/anthony/TFG/archivos/twomore/packs.json
2020-10-06T12:38:49.723+0200	DEBUG	[harvester]	log/harvester.go:580	Setting offset for file based on seek: /home/anthony/TFG/archivos/twomore/packs.json
2020-10-06T12:38:49.723+0200	DEBUG	[harvester]	log/harvester.go:566	Setting offset for file: /home/anthony/TFG/archivos/twomore/packs.json. Offset: 0 
2020-10-06T12:38:49.723+0200	DEBUG	[harvester]	log/harvester.go:207	Harvester setup successful. Line terminator: 1
2020-10-06T12:38:49.723+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
2020-10-06T12:38:49.723+0200	DEBUG	[publisher]	pipeline/client.go:221	Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16912651-51 PrevId: Finished:false Fileinfo:0xc000605e10 Source:/home/anthony/TFG/archivos/twomore/packs.json Offset:0 Timestamp:2020-10-06 12:38:49.723129635 +0200 CEST m=+0.486401212 TTL:-1ns Type:log Meta:map[] FileStateOS:16912651-51 IdentifierName:native} TimeSeries:false}
2020-10-06T12:38:49.723+0200	DEBUG	[harvester]	log/harvester.go:485	Update state: /home/anthony/TFG/archivos/twomore/packs.json, offset: 0
2020-10-06T12:38:49.723+0200	DEBUG	[input]	file/states.go:68	New state added for /home/anthony/TFG/archivos/twomore/packs.json
2020-10-06T12:38:49.723+0200	DEBUG	[input]	log/input.go:226	input states cleaned up. Before: 1, After: 1, Pending: 0
2020-10-06T12:38:49.723+0200	INFO	log/harvester.go:299	Harvester started for file: /home/anthony/TFG/archivos/twomore/packs.json
2020-10-06T12:38:49.723+0200	INFO	[detect_null_bytes]	debug/debug.go:95	Starting debug reader with a buffer size of 16384 and max failures of 100
2020-10-06T12:38:49.723+0200	DEBUG	[harvester]	log/harvester.go:495	Drop line as it does not match any of the include patterns 
2020-10-06T12:38:49.723+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
2020-10-06T12:38:49.723+0200	DEBUG	[input]	file/states.go:68	New state added for /home/anthony/TFG/archivos/twomore/packs.json
2020-10-06T12:38:49.723+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
2020-10-06T12:38:49.723+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
2020-10-06T12:38:49.724+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
2020-10-06T12:38:49.724+0200	DEBUG	[publisher]	pipeline/client.go:221	Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16912651-51 PrevId: Finished:false Fileinfo:0xc000605e10 Source:/home/anthony/TFG/archivos/twomore/packs.json Offset:62 Timestamp:2020-10-06 12:38:49.723129635 +0200 CEST m=+0.486401212 TTL:-1ns Type:log Meta:map[] FileStateOS:16912651-51 IdentifierName:native} TimeSeries:false}
2020-10-06T12:38:49.724+0200	DEBUG	[harvester]	log/harvester.go:495	Drop line as it does not match any of the include patterns 
2020-10-06T12:38:49.724+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
2020-10-06T12:38:49.724+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
2020-10-06T12:38:49.724+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
2020-10-06T12:38:49.724+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
2020-10-06T12:38:49.724+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
2020-10-06T12:38:49.724+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
2020-10-06T12:38:49.724+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.

Processing 1 events

2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
2020-10-06T12:38:49.725+0200	DEBUG	[publisher]	pipeline/client.go:221	Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16912651-51 PrevId: Finished:false Fileinfo:0xc000605e10 Source:/home/anthony/TFG/archivos/twomore/packs.json Offset:10846 Timestamp:2020-10-06 12:38:49.723129635 +0200 CEST m=+0.486401212 TTL:-1ns Type:log Meta:map[] FileStateOS:16912651-51 IdentifierName:native} TimeSeries:false}
2020-10-06T12:38:49.725+0200	DEBUG	[harvester]	log/harvester.go:495	Drop line as it does not match any of the include patterns 
2020-10-06T12:38:49.725+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
2020-10-06T12:38:49.725+0200	DEBUG	[publisher]	pipeline/client.go:221	Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16912651-51 PrevId: Finished:false Fileinfo:0xc000605e10 Source:/home/anthony/TFG/archivos/twomore/packs.json Offset:18376 Timestamp:2020-10-06 12:38:49.723129635 +0200 CEST m=+0.486401212 TTL:-1ns Type:log Meta:map[] FileStateOS:16912651-51 IdentifierName:native} TimeSeries:false}
2020-10-06T12:38:49.725+0200	DEBUG	[harvester]	log/harvester.go:495	Drop line as it does not match any of the include patterns 
2020-10-06T12:38:49.725+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
2020-10-06T12:38:49.725+0200	DEBUG	[publisher]	pipeline/client.go:221	Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16912651-51 PrevId: Finished:false Fileinfo:0xc000605e10 Source:/home/anthony/TFG/archivos/twomore/packs.json Offset:18438 Timestamp:2020-10-06 12:38:49.723129635 +0200 CEST m=+0.486401212 TTL:-1ns Type:log Meta:map[] FileStateOS:16912651-51 IdentifierName:native} TimeSeries:false}
2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
2020-10-06T12:38:49.749+0200	DEBUG	[harvester]	log/harvester.go:495	Drop line as it does not match any of the include patterns 
2020-10-06T12:38:49.749+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
2020-10-06T12:38:49.749+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
2020-10-06T12:38:49.749+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
2020-10-06T12:38:49.749+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
2020-10-06T12:38:49.749+0200	DEBUG	[harvester]	log/harvester.go:495	Drop line as it does not match any of the include patterns 
2020-10-06T12:38:49.749+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
2020-10-06T12:38:49.749+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
2020-10-06T12:38:49.749+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
2020-10-06T12:38:49.749+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
2020-10-06T12:38:49.749+0200	DEBUG	[harvester]	log/log.go:107	End of file reached: /home/anthony/TFG/archivos/twomore/packs.json; Backoff now.

I tried to delete de data registry directory but logstash doesn't receive any data from filebeat.

Apparently the lines in the file do not include that, resulting in

This is my input(4 first lines):

{"index":{"_index":"packets-2020-01-29","_type":"pcap_file"}}
{"timestamp":"1580316489257","layers":{"frame":{"frame_frame_interface_id":"0","frame_interface_id_frame_interface_name":"wlo1","frame_frame_encap_type":"1","frame_frame_time":"Jan 29, 2020 17:48:09.257671124 CET","frame_frame_offset_shift":"0.000000000","frame_frame_time_epoch":"1580316489.257671124","frame_frame_time_delta":"0.000000000","frame_frame_time_delta_displayed":"0.000000000","frame_frame_time_relative":"0.000000000","frame_frame_number":"1","frame_frame_len":"1514","frame_frame_cap_len":"1514","frame_frame_marked":"0","frame_frame_ignored":"0","frame_frame_protocols":"eth:ethertype:ip:tcp:tls"},"eth":{"eth_eth_dst":"00:23:15:ec:d3:58","eth_dst_eth_dst_resolved":"IntelCor_ec:d3:58","eth_dst_eth_addr":"00:23:15:ec:d3:58","eth_dst_eth_addr_resolved":"IntelCor_ec:d3:58","eth_dst_eth_lg":"0","eth_dst_eth_ig":"0","eth_eth_src":"30:7c:5e:a9:e3:00","eth_src_eth_src_resolved":"JuniperN_a9:e3:00","eth_src_eth_addr":"30:7c:5e:a9:e3:00","eth_src_eth_addr_resolved":"JuniperN_a9:e3:00","eth_src_eth_lg":"0","eth_src_eth_ig":"0","eth_eth_type":"0x00000800"},"ip":{"ip_ip_version":"4","ip_ip_hdr_len":"20","ip_ip_dsfield":"0x00000000","ip_dsfield_ip_dsfield_dscp":"0","ip_dsfield_ip_dsfield_ecn":"0","ip_ip_len":"1500","ip_ip_id":"0x00000b21","ip_ip_flags":"0x00000000","ip_flags_ip_flags_rb":"0","ip_flags_ip_flags_df":"0","ip_flags_ip_flags_mf":"0","ip_ip_frag_offset":"0","ip_ip_ttl":"120","ip_ip_proto":"6","ip_ip_checksum":"0x0000709f","ip_ip_checksum_status":"2","ip_ip_src":"130.206.193.111","ip_ip_addr":["130.206.193.111","10.182.114.104"],"ip_ip_src_host":"130.206.193.111","ip_ip_host":["130.206.193.111","10.182.114.104"],"ip_ip_dst":"10.182.114.104","ip_ip_dst_host":"10.182.114.104"},"tcp":{"tcp_tcp_srcport":"443","tcp_tcp_dstport":"39024","tcp_tcp_port":["443","39024"],"tcp_tcp_stream":"0","tcp_tcp_len":"1448","tcp_tcp_seq":"1","tcp_tcp_nxtseq":"1449","tcp_tcp_ack":"1","tcp_tcp_hdr_len":"32","tcp_tcp_flags":"0x00000010","tcp_flags_tcp_flags_res":"0","tcp_flags_tcp_flags_ns":"0","tcp_flags_tcp_flags_cwr":"0","tcp_flags_tcp_flags_ecn":"0","tcp_flags_tcp_flags_urg":"0","tcp_flags_tcp_flags_ack":"1","tcp_flags_tcp_flags_push":"0","tcp_flags_tcp_flags_reset":"0","tcp_flags_tcp_flags_syn":"0","tcp_flags_tcp_flags_fin":"0","tcp_flags_tcp_flags_str":"·······A····","tcp_tcp_window_size_value":"404","tcp_tcp_window_size":"404","tcp_tcp_window_size_scalefactor":"-1","tcp_tcp_checksum":"0x00001485","tcp_tcp_checksum_status":"2","tcp_tcp_urgent_pointer":"0","tcp_tcp_options":"01:01:08:0a:3d:e1:09:6e:e5:3a:c6:b9","tcp_options_tcp_options_nop":["01","01"],"tcp_options_nop_tcp_option_kind":["1","1"],"tcp_options_tcp_options_timestamp":"08:0a:3d:e1:09:6e:e5:3a:c6:b9","tcp_options_timestamp_tcp_option_kind":"8","tcp_options_timestamp_tcp_option_len":"10","tcp_options_timestamp_tcp_options_timestamp_tsval":"1038158190","tcp_options_timestamp_tcp_options_timestamp_tsecr":"3845834425","tcp_tcp_analysis":null,"tcp_analysis_tcp_analysis_bytes_in_flight":"1448","tcp_analysis_tcp_analysis_push_bytes_sent":"1448","tcp_text":"Timestamps","text_tcp_time_relative":"0.000000000","text_tcp_time_delta":"0.000000000","tcp_tcp_payload":"ff:e0:a1:96:ff:44:c5:98:5a:b9:28:2b:13:70:3a:6f:19:f2:d5:a8:f8:ec:80:98:70:82:aa:35:bc:b4:6d:23:9c:98:dc:5f:02:23:7a:1b:e8:4a:8d:c1:d6:16:a1:0b:d5:c5:26:29:7d:40:a9:f9:39:60:ab:ad:f5:de:36:09:b6:9c:f8:32:69:1c:ef:ac:84:af:16:72:dd:bd:e4:81:37:a5:4f:7a:ea:4e:6d:58:40:ba:24:a7:d9:00:cf:40:25:6f:f7:45:70:92:64:a8:d1:1a:1d:84:82:17:08:be:66:75:d3:a8:1d:b5:d8:6b:4a:5f:26:3e:78:55:6a:fb:ab:ff:db:62:71:bb:4b:29:9d:bb:7b:55:09:00:ed:e8:52:8f:75:2e:85:49:56:51:46:f7:5c:c8:7b:47:e9:5a:1c:ef:57:19:ec:fc:33:7f:a8:fc:04:f5:41:04:4d:7a:14:28:06:f3:9b:70:a5:6e:ea:c3:a9:7b:ea:5e:f4:20:90:c2:e7:ee:30:7c:18:50:83:22:ff:79:dd:17:79:10:f6:60:84:a1:ec:00:2c:32:f2:ba:5d:eb:40:14:71:23:c1:6e:f1:d2:41:f3:37:9a:cb:17:51:03:90:5d:2e:88:95:0b:6c:88:df:6c:ab:db:6f:a5:9a:d8:1b:4e:b2:cf:1f:23:10:03:3a:30:e5:8a:89:a7:e3:49:6d:69:24:fd:2d:32:6e:eb:84:7b:e6:66:5f:b7:d9:63:28:49:5f:33:13:8e:7e:79:79:ca:49:50:ef:08:f3:b8:33:dd:31:25:72:e6:df:c6:c6:9e:36:af:21:84:f2:d5:82:d7:13:07:8b:8b:e3:41:9a:20:5d:dc:e5:ef:29:d8:93:3b:95:07:60:b3:d2:76:1f:31:28:bf:97:06:60:07:1b:a6:11:90:c6:7e:6d:dd:b5:fa:02:13:7c:2d:5f:fc:98:22:a2:41:f8:9c:57:dd:84:f5:b1:41:d8:5f:41:d7:f2:37:ea:e8:e2:6d:0b:7b:76:de:36:bc:51:86:26:80:e4:33:1f:bf:82:24:1d:1b:c8:a3:07:29:3a:19:c3:47:3e:e2:87:9f:28:c2:a1:65:c1:b1:4b:1d:b2:b0:d3:22:85:7d:c0:67:ab:8c:7f:e9:c1:40:00:ae:f4:d8:81:57:dd:86:8e:b7:89:f3:5f:99:99:17:8f:de:9f:44:cb:08:ff:ff:23:b6:05:ca:83:a7:f0:bc:b0:6b:02:ae:fc:a9:fa:d6:90:85:31:b1:fb:4d:a4:12:7f:37:0b:35:20:5b:48:db:ee:7f:80:77:0a:6a:60:ad:71:f9:69:9d:c8:3b:51:9c:5d:61:40:d9:6e:6f:6b:5b:e6:f5:5e:bd:fa:8a:55:b6:bb:1f:ec:bf:1b:12:da:c6:e2:57:d6:d4:f5:69:c1:6b:5d:a3:da:a4:41:5f:e2:e3:63:e0:68:bc:f7:e1:ea:71:6d:a5:2a:03:62:e2:a7:3d:ac:92:d5:88:28:79:79:94:8d:63:cd:8d:f8:52:18:18:50:ff:61:7c:11:77:55:c6:12:94:53:37:38:48:bf:60:af:6e:2d:8a:c8:ac:3c:52:f3:12:4d:50:88:6c:e9:c9:2d:0a:4c:dc:a3:f4:a0:7d:77:ba:18:93:d2:91:3e:76:1d:67:b3:9f:86:73:4e:89:c9:bf:46:60:d8:ee:1f:57:01:24:ea:3f:f2:b3:43:c7:3b:ab:40:6c:46:0c:65:65:23:b4:b2:ac:49:62:0e:0a:12:7b:1b:e2:ca:5b:d9:87:36:36:06:1c:39:3e:21:f7:95:18:e9:7e:bd:58:9b:f6:e9:5b:05:8e:8a:cf:ba:32:63:f2:09:e8:fb:89:ef:62:db:05:20:10:99:ec:4c:1d:75:13:cf:25:fb:04:b1:ee:9a:0f:35:07:94:22:a5:e9:10:2a:62:5d:f8:ff:f8:c6:34:6b:a2:de:25:ae:a3:d7:42:a1:e9:fe:7f:6d:36:4d:c8:3d:95:70:46:81:55:ba:c2:21:af:eb:23:ce:ae:57:71:38:a6:62:a4:07:38:43:bd:ca:19:12:56:ef:29:5d:51:3d:c8:df:ce:ce:93:15:3c:b1:e2:4b:41:d7:40:4b:77:fc:c8:dd:d6:d7:ce:75:e9:07:05:b9:40:f9:4f:a4:92:0b:ec:64:25:58:82:2f:31:b8:15:26:48:88:f6:0a:24:a1:58:86:5f:67:06:d6:93:20:54:21:26:77:ba:0b:3d:52:9a:59:a1:5b:b3:35:8f:15:2d:22:b6:d4:47:52:2d:41:4d:80:ee:ed:5c:3f:49:5d:c2:4e:88:77:96:28:0e:d2:c4:42:44:02:7f:18:77:46:e0:27:f8:87:f2:68:14:cd:b0:45:d0:5a:f0:75:aa:bb:64:f0:1b:bb:c1:a6:64:6c:0b:1e:c5:7e:30:d8:64:78:e9:f4:a6:50:72:45:d4:53:df:c7:69:c2:9e:b7:3b:f6:a4:6a:51:09:05:16:53:96:a6:5e:27:50:2b:6f:07:dd:65:ac:e0:de:ee:1f:0e:3c:b3:37:ba:cd:6c:ac:94:28:d0:55:9f:5c:94:9c:b9:9f:35:7f:c7:78:91:f9:47:16:b5:60:a1:35:e3:c0:74:57:44:ef:e1:fc:93:2c:f4:8f:f7:ba:0d:06:c2:c4:54:71:a5:08:1e:dc:da:ad:89:ee:23:55:05:57:c7:30:75:b3:53:78:b3:3e:2c:b5:d9:04:57:92:37:dd:6c:a2:b1:4e:60:24:f1:cb:9f:fc:d9:25:cc:df:a8:f4:6a:74:72:e8:42:90:b4:f9:08:99:d5:56:78:7c:5c:77:92:4a:e9:65:cc:5d:17:f0:cf:7a:d1:66:68:d1:ad:d4:f1:26:a1:94:49:36:ad:87:c9:86:78:0b:6f:32:cf:b3:72:a0:ee:14:7f:28:e5:01:f5:93:b6:b0:85:85:dd:15:73:0f:f8:2b:08:fd:3d:1d:c3:2b:49:4a:27:bd:6f:dc:2a:bd:44:2a:31:9e:60:b1:b6:f6:e3:2f:11:b6:98:4b:fc:75:d1:84:0f:b8:72:8f:22:c0:d5:7b:83:74:95:69:d3:25:56:ad:c0:95:dd:05:86:13:fd:6a:ee:de:7d:28:e9:1b:80:70:c2:7a:98:50:10:08:39:33:36:08:4e:d8:7b:f6:86:ce:d9:e6:38:e0:49:38:d9:6f:82:f9:10:dc:4a:54:21:98:20:c4:ba:95:3e:7c:ca:47:dc:7c:51:bf:74:39:3c:0e:46:f3:03:44:57:49:ee:6b:26:9f:51:91:71:04:55:f4:c7:96:34:be:2e:a1:9e:09:17:78:7f:90:8d:dc:17:bd:a9:8a:c6:ea:23:8f:f1:ac:28:a9:21:13:b9:7e:15:63:c9:e5:02:2d:23:e5:d0:3b:03:d2:ab:24:ed:b1:7d:c2:7d:59:0b:1f:b6:ea:2b:03:e2:27:27:8f:17:26:ad:3e:0c:33:e0:ca:0f:f2:81:14:64:bf:32:6f:82:57:e3:b8:39:75:e4:12:53:66:9f:94:b2:72:8e:07:16:6b:1f:f6:02:97:e5:f5:77:11:9b:a0:c0:eb:30:91:ef:c7:d4:70:c1:9a:f1:09:84:d5:e1:d7:4a:1c:90:2e:c3:8f:16:d5:c1:e6:95:e2:6e:56:a7:45:13:18:2e:4f:74:10:4d:72:c2:84:0e:4c:00:86:48:4b:eb:13:31:6b:b8:13:1a:83:ae:cb:fb:35:d5:bb:cb:8b:cc:5e:6e:96:23:ac:8f:97:df:ae:37:93:9b:09:45:b6:74:6b:bd:23:42:e9:e4:ff"},"tls":{}}}
{"index":{"_index":"packets-2020-01-29","_type":"pcap_file"}}
{"timestamp":"1580316489257","layers":{"frame":{"frame_frame_interface_id":"0","frame_interface_id_frame_interface_name":"wlo1","frame_frame_encap_type":"1","frame_frame_time":"Jan 29, 2020 17:48:09.257724230 CET","frame_frame_offset_shift":"0.000000000","frame_frame_time_epoch":"1580316489.257724230","frame_frame_time_delta":"0.000053106","frame_frame_time_delta_displayed":"0.000053106","frame_frame_time_relative":"0.000053106","frame_frame_number":"2","frame_frame_len":"66","frame_frame_cap_len":"66","frame_frame_marked":"0","frame_frame_ignored":"0","frame_frame_protocols":"eth:ethertype:ip:tcp"},"eth":{"eth_eth_dst":"30:7c:5e:a9:e3:00","eth_dst_eth_dst_resolved":"JuniperN_a9:e3:00","eth_dst_eth_addr":"30:7c:5e:a9:e3:00","eth_dst_eth_addr_resolved":"JuniperN_a9:e3:00","eth_dst_eth_lg":"0","eth_dst_eth_ig":"0","eth_eth_src":"00:23:15:ec:d3:58","eth_src_eth_src_resolved":"IntelCor_ec:d3:58","eth_src_eth_addr":"00:23:15:ec:d3:58","eth_src_eth_addr_resolved":"IntelCor_ec:d3:58","eth_src_eth_lg":"0","eth_src_eth_ig":"0","eth_eth_type":"0x00000800"},"ip":{"ip_ip_version":"4","ip_ip_hdr_len":"20","ip_ip_dsfield":"0x00000000","ip_dsfield_ip_dsfield_dscp":"0","ip_dsfield_ip_dsfield_ecn":"0","ip_ip_len":"52","ip_ip_id":"0x0000e82b","ip_ip_flags":"0x00004000","ip_flags_ip_flags_rb":"0","ip_flags_ip_flags_df":"1","ip_flags_ip_flags_mf":"0","ip_ip_frag_offset":"0","ip_ip_ttl":"64","ip_ip_proto":"6","ip_ip_checksum":"0x0000913c","ip_ip_checksum_status":"2","ip_ip_src":"10.182.114.104","ip_ip_addr":["10.182.114.104","130.206.193.111"],"ip_ip_src_host":"10.182.114.104","ip_ip_host":["10.182.114.104","130.206.193.111"],"ip_ip_dst":"130.206.193.111","ip_ip_dst_host":"130.206.193.111"},"tcp":{"tcp_tcp_srcport":"39024","tcp_tcp_dstport":"443","tcp_tcp_port":["39024","443"],"tcp_tcp_stream":"0","tcp_tcp_len":"0","tcp_tcp_seq":"1","tcp_tcp_nxtseq":"1","tcp_tcp_ack":"1449","tcp_tcp_hdr_len":"32","tcp_tcp_flags":"0x00000010","tcp_flags_tcp_flags_res":"0","tcp_flags_tcp_flags_ns":"0","tcp_flags_tcp_flags_cwr":"0","tcp_flags_tcp_flags_ecn":"0","tcp_flags_tcp_flags_urg":"0","tcp_flags_tcp_flags_ack":"1","tcp_flags_tcp_flags_push":"0","tcp_flags_tcp_flags_reset":"0","tcp_flags_tcp_flags_syn":"0","tcp_flags_tcp_flags_fin":"0","tcp_flags_tcp_flags_str":"·······A····","tcp_tcp_window_size_value":"7720","tcp_tcp_window_size":"7720","tcp_tcp_window_size_scalefactor":"-1","tcp_tcp_checksum":"0x0000a841","tcp_tcp_checksum_status":"2","tcp_tcp_urgent_pointer":"0","tcp_tcp_options":"01:01:08:0a:e5:3a:c6:ec:3d:e1:09:6e","tcp_options_tcp_options_nop":["01","01"],"tcp_options_nop_tcp_option_kind":["1","1"],"tcp_options_tcp_options_timestamp":"08:0a:e5:3a:c6:ec:3d:e1:09:6e","tcp_options_timestamp_tcp_option_kind":"8","tcp_options_timestamp_tcp_option_len":"10","tcp_options_timestamp_tcp_options_timestamp_tsval":"3845834476","tcp_options_timestamp_tcp_options_timestamp_tsecr":"1038158190","tcp_tcp_analysis":null,"tcp_analysis_tcp_analysis_acks_frame":"1","tcp_analysis_tcp_analysis_ack_rtt":"0.000053106","tcp_text":"Timestamps","text_tcp_time_relative":"0.000053106","text_tcp_time_delta":"0.000053106"}}}

I'm trying to include the line 2, 4, 6, .... these lines has a field "ip_ip_addr" that is why I wrote that pattern.
I bet there is a better way for do that but I'm a begginer with these tools...

Thank you.