# JSON file -\> Filebeat -\> Logstash

**URL:** <https://discuss.elastic.co/t/json-file-filebeat-logstash/250636>\
**Category:** Logstash\
**Created:** [October 1, 2020, 9:57am UTC](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636 "2020-10-01T09:57:31Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![AnthonyS4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anthonys4/32/45312_2.png) [@AnthonyS4](https://discuss.elastic.co/u/AnthonyS4)\
**Post date:** [October 1, 2020, 9:57am UTC](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636/1 "2020-10-01T09:57:31Z")

</div>

Hi, I'm trying to parse a JSON file with Filebeat and then send it to Logstash, Logstash is not receiving data then there is no an output file, these are my configs.yml:

_filebeat.yml_

```
filebeat.inputs:
  - type: log

    enabled: true
    include_lines: ["ip_ip"]

    paths:
      - /input_path/output.json
    json.keys_under_root: true
    json.message_key: true

output.logstash:
  hosts: ["localhost:5044"]
  enabled: true

```

_first-pipeline.conf_

```
    input {
      beats {
    	port => "5044"	
      }
    }
    output {
      file{
        path => "output_path/output.json"
      }
    }

```

Thank you.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 1, 2020, 2:14pm UTC](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636/2 "2020-10-01T14:14:09Z")

</div>

What do the filebeat and logstash logs contain? If there are no errors try increasing the log level in filebeat to debug.

---

<div class="post-metadata">

**Author:** ![AnthonyS4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anthonys4/32/45312_2.png) [@AnthonyS4](https://discuss.elastic.co/u/AnthonyS4)\
**Post date:** [October 1, 2020, 4:51pm UTC](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636/3 "2020-10-01T16:51:28Z")

</div>

**Logstash log:**

[2020-10-01T16:55:56,547][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.9.2", "jruby.version"=\>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc IBM J9 VM 2.9 on 8.0.6.0 - pxa6480sr6-20191107\_01(SR6) +indy +jit [linux-x86\_64]"}  
[2020-10-01T16:55:56,969][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[2020-10-01T16:55:58,202][INFO][org.reflections.Reflections] Reflections took 40 ms to scan 1 urls, producing 22 keys and 45 values  
[2020-10-01T16:55:58,741][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>500, "pipeline.sources"=\>["/usr/share/logstash/first-pipeline.conf"], :thread=\>"#\<Thread:0x327382fe run\>"}  
[2020-10-01T16:55:59,522][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=\>0.77}  
[2020-10-01T16:55:59,541][INFO][logstash.inputs.beats][main] Beats inputs: Starting input listener {:address=\>"0.0.0.0:5044"}  
[2020-10-01T16:55:59,555][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=\>"main"}  
[2020-10-01T16:55:59,701][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}  
[2020-10-01T16:55:59,722][INFO][org.logstash.beats.Server][main][4dc0dee64e2348cb558550456efb278f18c4ef4270e7608ecfef7557dd307ab5] Starting server on port: 5044  
[2020-10-01T16:56:00,087][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2020-10-01T16:57:22,880][WARN][logstash.runner] SIGINT received. Shutting down.  
[2020-10-01T16:57:27,962][WARN][logstash.runner] Received shutdown signal, but pipeline is still waiting for in-flight events  
to be processed. Sending another ^C will force quit Logstash, but this may cause  
data loss.  
[2020-10-01T16:57:31,183][INFO][logstash.javapipeline] Pipeline terminated {"pipeline.id"=\>"main"}  
[2020-10-01T16:57:31,225][INFO][logstash.runner] Logstash shut down.

**Filebeat log:**

2020-10-01T17:02:36.355+0200 INFO instance/beat.go:640 Home path: [/home/anthony/beats/filebeat-7.9.2-linux-x86\_64] Config path: [/home/anthony/beats/filebeat-7.9.2-linux-x86\_64] Data path: [/home/anthony/beats/filebeat-7.9.2-linux-x86\_64/data] Logs path: [/home/anthony/beats/filebeat-7.9.2-linux-x86\_64/logs]  
2020-10-01T17:02:36.355+0200 DEBUG [beat] instance/beat.go:692 Beat metadata path: /home/anthony/beats/filebeat-7.9.2-linux-x86\_64/data/meta.json  
2020-10-01T17:02:36.355+0200 INFO instance/beat.go:648 Beat ID: 9d5480c8-0124-41fa-8336-d5730f03b601  
2020-10-01T17:02:36.356+0200 DEBUG [seccomp] seccomp/seccomp.go:117 Loading syscall filter {"seccomp\_filter": {"no\_new\_privs":true,"flag":"tsync","policy":{"default\_action":"errno","syscalls":[{"names":["accept","accept4","access","arch\_prctl","bind","brk","chmod","chown","clock\_gettime","clone","close","connect","dup","dup2","epoll\_create","epoll\_create1","epoll\_ctl","epoll\_pwait","epoll\_wait","exit","exit\_group","fchdir","fchmod","fchmodat","fchown","fchownat","fcntl","fdatasync","flock","fstat","fstatfs","fsync","ftruncate","futex","getcwd","getdents","getdents64","geteuid","getgid","getpeername","getpid","getppid","getrandom","getrlimit","getrusage","getsockname","getsockopt","gettid","gettimeofday","getuid","inotify\_add\_watch","inotify\_init1","inotify\_rm\_watch","ioctl","kill","listen","lseek","lstat","madvise","mincore","mkdirat","mmap","mprotect","munmap","nanosleep","newfstatat","open","openat","pipe","pipe2","poll","ppoll","pread64","pselect6","pwrite64","read","readlink","readlinkat","recvfrom","recvmmsg","recvmsg","rename","renameat","rt\_sigaction","rt\_sigprocmask","rt\_sigreturn","sched\_getaffinity","sched\_yield","sendfile","sendmmsg","sendmsg","sendto","set\_robust\_list","setitimer","setsockopt","shutdown","sigaltstack","socket","splice","stat","statfs","sysinfo","tgkill","time","tkill","uname","unlink","unlinkat","wait4","waitid","write","writev"],"action":"allow"}]}}}  
2020-10-01T17:02:36.356+0200 INFO [seccomp] seccomp/seccomp.go:124 Syscall filter successfully installed  
2020-10-01T17:02:36.356+0200 INFO [beat] instance/beat.go:976 Beat info {"system\_info": {"beat": {"path": {"config": "/home/anthony/beats/filebeat-7.9.2-linux-x86\_64", "data": "/home/anthony/beats/filebeat-7.9.2-linux-x86\_64/data", "home": "/home/anthony/beats/filebeat-7.9.2-linux-x86\_64", "logs": "/home/anthony/beats/filebeat-7.9.2-linux-x86\_64/logs"}, "type": "filebeat", "uuid": "9d5480c8-0124-41fa-8336-d5730f03b601"}}}  
2020-10-01T17:02:36.356+0200 INFO [beat] instance/beat.go:985 Build info {"system\_info": {"build": {"commit": "2ab907f5ccecf9fd82fe37105082e89fd871f684", "libbeat": "7.9.2", "time": "2020-09-22T23:19:45.000Z", "version": "7.9.2"}}}  
2020-10-01T17:02:36.356+0200 INFO [beat] instance/beat.go:988 Go runtime info {"system\_info": {"go": {"os":"linux","arch":"amd64","max\_procs":4,"version":"go1.14.7"}}}  
2020-10-01T17:02:36.357+0200 INFO [beat] instance/beat.go:992 Host info {"system\_info": {"host": {"architecture":"x86\_64","boot\_time":"2020-10-01T10:53:06+02:00","containerized":false,"name":"Anthony-HP-Pavilion-Notebook","ip":["127.0.0.1/8","::1/128","10.182.107.109/16","fe80::371f:84e8:e0c7:39ee/64","172.17.0.1/16"],"kernel\_version":"4.15.0-20-generic","mac":["80:ce:62:45:e6:d7","00:23:15:ec:d3:58","02:42:fa:9c:8f:ac"],"os":{"family":"","platform":"linuxmint","name":"Linux Mint","version":"19.1 (Tessa)","major":19,"minor":1,"patch":0,"codename":"tessa"},"timezone":"CEST","timezone\_offset\_sec":7200,"id":"82929df7ee394b73b81252fe3b4e5020"}}}  
2020-10-01T17:02:36.357+0200 INFO [beat] instance/beat.go:1021 Process info {"system\_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read"],"effective":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read"],"bounding":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read"],"ambient":null}, "cwd": "/home/anthony/beats/filebeat-7.9.2-linux-x86\_64", "exe": "/home/anthony/beats/filebeat-7.9.2-linux-x86\_64/filebeat", "name": "filebeat", "pid": 9882, "ppid": 9881, "seccomp": {"mode":"filter","no\_new\_privs":true}, "start\_time": "2020-10-01T17:02:35.540+0200"}}}  
2020-10-01T17:02:36.357+0200 INFO instance/beat.go:299 Setup Beat: filebeat; Version: 7.9.2  
2020-10-01T17:02:36.357+0200 DEBUG [beat] instance/beat.go:325 Initializing output plugins  
2020-10-01T17:02:36.357+0200 DEBUG [publisher] pipeline/consumer.go:148 start pipeline event consumer  
2020-10-01T17:02:36.357+0200 INFO [publisher] pipeline/module.go:113 Beat name: Anthony-HP-Pavilion-Notebook  
2020-10-01T17:02:36.358+0200 WARN beater/filebeat.go:178 Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.  
2020-10-01T17:02:36.359+0200 INFO [monitoring] log/log.go:118 Starting metrics logging every 30s  
2020-10-01T17:02:36.359+0200 INFO instance/beat.go:450 filebeat start running.  
2020-10-01T17:02:36.359+0200 DEBUG [test] registrar/migrate.go:304 isFile(/home/anthony/beats/filebeat-7.9.2-linux-x86\_64/data/registry) -\> false  
2020-10-01T17:02:36.359+0200 DEBUG [test] registrar/migrate.go:304 isFile() -\> false  
2020-10-01T17:02:36.359+0200 DEBUG [test] registrar/migrate.go:297 isDir(/home/anthony/beats/filebeat-7.9.2-linux-x86\_64/data/registry/filebeat) -\> true  
2020-10-01T17:02:36.359+0200 DEBUG [test] registrar/migrate.go:304 isFile(/home/anthony/beats/filebeat-7.9.2-linux-x86\_64/data/registry/filebeat/meta.json) -\> true  
2020-10-01T17:02:36.359+0200 DEBUG [registrar] registrar/migrate.go:84 Registry type '1' found  
2020-10-01T17:02:36.359+0200 INFO memlog/store.go:119 Loading data file of '/home/anthony/beats/filebeat-7.9.2-linux-x86\_64/data/registry/filebeat' succeeded. Active transaction id=0  
2020-10-01T17:02:36.359+0200 INFO memlog/store.go:124 Finished loading transaction log file for '/home/anthony/beats/filebeat-7.9.2-linux-x86\_64/data/registry/filebeat'. Active transaction id=12  
2020-10-01T17:02:36.359+0200 WARN beater/filebeat.go:381 Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.  
2020-10-01T17:02:36.359+0200 INFO [registrar] registrar/registrar.go:109 States Loaded from registrar: 1  
2020-10-01T17:02:36.359+0200 INFO [crawler] beater/crawler.go:71 Loading Inputs: 1  
2020-10-01T17:02:36.360+0200 DEBUG [registrar] registrar/registrar.go:140 Starting Registrar  
2020-10-01T17:02:36.360+0200 DEBUG [input] log/config.go:207 recursive glob enabled  
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:169 exclude\_files: . Number of states: 1  
2020-10-01T17:02:36.360+0200 DEBUG [input] file/states.go:68 New state added for /home/anthony/TFG/archivos/packs.json  
2020-10-01T17:02:36.360+0200 DEBUG [acker] beater/acker.go:59 stateful ack {"count": 1}  
2020-10-01T17:02:36.360+0200 DEBUG [publisher] pipeline/client.go:221 Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16913446-51 PrevId: Finished:true Fileinfo: Source:/home/anthony/TFG/archivos/packs.json Offset:29163 Timestamp:2020-10-01 16:56:03.272087794 +0200 CEST TTL:-1ns Type:log Meta:map FileStateOS:16913446-51 IdentifierName:native} TimeSeries:false}  
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:199 input with previous states loaded: 1  
2020-10-01T17:02:36.360+0200 INFO log/input.go:157 Configured paths: [/home/anthony/TFG/archivos/packs.json]  
2020-10-01T17:02:36.360+0200 DEBUG [registrar] registrar/registrar.go:264 Processing 1 events  
2020-10-01T17:02:36.360+0200 INFO [crawler] beater/crawler.go:141 Starting input (ID: 3115676435086966116)  
2020-10-01T17:02:36.360+0200 DEBUG [registrar] registrar/registrar.go:231 Registrar state updates processed. Count: 1  
2020-10-01T17:02:36.360+0200 DEBUG [registrar] registrar/registrar.go:254 Registrar states cleaned up. Before: 1, After: 1, Pending: 0  
2020-10-01T17:02:36.360+0200 DEBUG [registrar] registrar/registrar.go:201 Registry file updated. 1 active states.  
2020-10-01T17:02:36.360+0200 INFO [crawler] beater/crawler.go:108 Loading and starting Inputs completed. Enabled inputs: 1  
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:205 Start next scan  
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:439 Check file for harvesting: /home/anthony/TFG/archivos/packs.json  
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:530 Update existing file for harvesting: /home/anthony/TFG/archivos/packs.json, offset: 29163  
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:584 File didn't change: /home/anthony/TFG/archivos/packs.json  
2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:226 input states cleaned up. Before: 1, After: 1, Pending: 0

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 1, 2020, 5:16pm UTC](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636/4 "2020-10-01T17:16:10Z")

</div>

> [@AnthonyS4](#):
>
> 2020-10-01T17:02:36.360+0200 DEBUG [publisher] pipeline/client.go:221 Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16913446-51 PrevId: Finished:true Fileinfo: Source:/home/anthony/TFG/archivos/packs.json **Offset:29163** Timestamp:2020-10-01 16:56:03.272087794 +0200 CEST TTL:-1ns Type:log Meta:map FileStateOS:16913446-51 IdentifierName:native} TimeSeries:false}  
> ...  
> 2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:530 Update existing file for harvesting: /home/anthony/TFG/archivos/packs.json, **offset: 29163**  
> 2020-10-01T17:02:36.360+0200 DEBUG [input] log/input.go:584 File didn't change: /home/anthony/TFG/archivos/packs.json

If I am reading that correctly, then it thinks it has previously read 29163 bytes from archivos/packs.json and the current file size is 29163, so there is no new data.

The fact that it has already read the file is recorded in the registry

```
/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry/filebeat/meta.json

```

Stop filebeat, move that file somewhere else, then start filebeat again. See if it re-reads the file.

---

<div class="post-metadata">

**Author:** ![AnthonyS4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anthonys4/32/45312_2.png) [@AnthonyS4](https://discuss.elastic.co/u/AnthonyS4)\
**Post date:** [October 6, 2020, 10:53am UTC](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636/5 "2020-10-06T10:53:02Z")

</div>

Thank you for reply.  
I tried that and i got this:

> ```
> 2020-10-06T12:38:49.584+0200	INFO	instance/beat.go:648	Beat ID: 5a2c132e-5bd3-4710-8048-dc7d7c5adc92
> 2020-10-06T12:38:49.585+0200	INFO	[seccomp]	seccomp/seccomp.go:124	Syscall filter successfully installed
> 2020-10-06T12:38:49.585+0200	INFO	[beat]	instance/beat.go:985	Build info	{"system_info": {"build": {"commit": "2ab907f5ccecf9fd82fe37105082e89fd871f684", "libbeat": "7.9.2", "time": "2020-09-22T23:19:45.000Z", "version": "7.9.2"}}}
> 2020-10-06T12:38:49.585+0200	INFO	[beat]	instance/beat.go:988	Go runtime info	{"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":4,"version":"go1.14.7"}}}
> 2020-10-06T12:38:49.586+0200	INFO	instance/beat.go:299	Setup Beat: filebeat; Version: 7.9.2
> 2020-10-06T12:38:49.586+0200	DEBUG	[beat]	instance/beat.go:325	Initializing output plugins
> 2020-10-06T12:38:49.587+0200	DEBUG	[publisher]	pipeline/consumer.go:148	start pipeline event consumer
> 2020-10-06T12:38:49.587+0200	INFO	[publisher]	pipeline/module.go:113	Beat name: Anthony-HP-Pavilion-Notebook
> 2020-10-06T12:38:49.588+0200	WARN	beater/filebeat.go:178	Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
> 2020-10-06T12:38:49.588+0200	INFO	instance/beat.go:450	filebeat start running.
> 2020-10-06T12:38:49.588+0200	DEBUG	[test]	registrar/migrate.go:304	isFile(/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry) -> false
> 2020-10-06T12:38:49.588+0200	DEBUG	[test]	registrar/migrate.go:304	isFile() -> false
> 2020-10-06T12:38:49.588+0200	DEBUG	[test]	registrar/migrate.go:297	isDir(/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry/filebeat) -> false
> 2020-10-06T12:38:49.588+0200	DEBUG	[registrar]	registrar/migrate.go:84	Registry type '' found
> 2020-10-06T12:38:49.588+0200	DEBUG	[test]	registrar/migrate.go:304	isFile(.bak) -> false
> 2020-10-06T12:38:49.588+0200	INFO	[monitoring]	log/log.go:118	Starting metrics logging every 30s
> 2020-10-06T12:38:49.722+0200	INFO	memlog/store.go:119	Loading data file of '/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry/filebeat' succeeded. Active transaction id=0
> 2020-10-06T12:38:49.722+0200	INFO	memlog/store.go:124	Finished loading transaction log file for '/home/anthony/beats/filebeat-7.9.2-linux-x86_64/data/registry/filebeat'. Active transaction id=0
> 2020-10-06T12:38:49.722+0200	WARN	beater/filebeat.go:381	Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
> 2020-10-06T12:38:49.722+0200	INFO	[registrar]	registrar/registrar.go:109	States Loaded from registrar: 0
> 2020-10-06T12:38:49.722+0200	INFO	[crawler]	beater/crawler.go:71	Loading Inputs: 1
> 2020-10-06T12:38:49.722+0200	DEBUG	[registrar]	registrar/registrar.go:140	Starting Registrar
> 2020-10-06T12:38:49.722+0200	DEBUG	[input]	log/config.go:207	recursive glob enabled
> 2020-10-06T12:38:49.722+0200	DEBUG	[input]	log/input.go:169	exclude_files: []. Number of states: 0
> 2020-10-06T12:38:49.722+0200	DEBUG	[input]	log/input.go:199	input with previous states loaded: 0
> 2020-10-06T12:38:49.723+0200	INFO	log/input.go:157	Configured paths: [/home/anthony/TFG/archivos/twomore/packs.json]
> 2020-10-06T12:38:49.723+0200	INFO	[crawler]	beater/crawler.go:141	Starting input (ID: 9329501670631896042)
> 2020-10-06T12:38:49.723+0200	INFO	[crawler]	beater/crawler.go:108	Loading and starting Inputs completed. Enabled inputs: 1
> 2020-10-06T12:38:49.723+0200	DEBUG	[input]	log/input.go:205	Start next scan
> 2020-10-06T12:38:49.723+0200	DEBUG	[input]	log/input.go:439	Check file for harvesting: /home/anthony/TFG/archivos/twomore/packs.json
> 2020-10-06T12:38:49.723+0200	DEBUG	[input]	log/input.go:512	Start harvester for new file: /home/anthony/TFG/archivos/twomore/packs.json
> 2020-10-06T12:38:49.723+0200	DEBUG	[harvester]	log/harvester.go:580	Setting offset for file based on seek: /home/anthony/TFG/archivos/twomore/packs.json
> 2020-10-06T12:38:49.723+0200	DEBUG	[harvester]	log/harvester.go:566	Setting offset for file: /home/anthony/TFG/archivos/twomore/packs.json. Offset: 0 
> 2020-10-06T12:38:49.723+0200	DEBUG	[harvester]	log/harvester.go:207	Harvester setup successful. Line terminator: 1
> 2020-10-06T12:38:49.723+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
> 2020-10-06T12:38:49.723+0200	DEBUG	[publisher]	pipeline/client.go:221	Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16912651-51 PrevId: Finished:false Fileinfo:0xc000605e10 Source:/home/anthony/TFG/archivos/twomore/packs.json Offset:0 Timestamp:2020-10-06 12:38:49.723129635 +0200 CEST m=+0.486401212 TTL:-1ns Type:log Meta:map[] FileStateOS:16912651-51 IdentifierName:native} TimeSeries:false}
> 2020-10-06T12:38:49.723+0200	DEBUG	[harvester]	log/harvester.go:485	Update state: /home/anthony/TFG/archivos/twomore/packs.json, offset: 0
> 2020-10-06T12:38:49.723+0200	DEBUG	[input]	file/states.go:68	New state added for /home/anthony/TFG/archivos/twomore/packs.json
> 2020-10-06T12:38:49.723+0200	DEBUG	[input]	log/input.go:226	input states cleaned up. Before: 1, After: 1, Pending: 0
> 2020-10-06T12:38:49.723+0200	INFO	log/harvester.go:299	Harvester started for file: /home/anthony/TFG/archivos/twomore/packs.json
> 2020-10-06T12:38:49.723+0200	INFO	[detect_null_bytes]	debug/debug.go:95	Starting debug reader with a buffer size of 16384 and max failures of 100
> 2020-10-06T12:38:49.723+0200	DEBUG	[harvester]	log/harvester.go:495	Drop line as it does not match any of the include patterns 
> 2020-10-06T12:38:49.723+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
> 2020-10-06T12:38:49.723+0200	DEBUG	[input]	file/states.go:68	New state added for /home/anthony/TFG/archivos/twomore/packs.json
> 2020-10-06T12:38:49.723+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
> 2020-10-06T12:38:49.723+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
> 2020-10-06T12:38:49.724+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
> 2020-10-06T12:38:49.724+0200	DEBUG	[publisher]	pipeline/client.go:221	Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16912651-51 PrevId: Finished:false Fileinfo:0xc000605e10 Source:/home/anthony/TFG/archivos/twomore/packs.json Offset:62 Timestamp:2020-10-06 12:38:49.723129635 +0200 CEST m=+0.486401212 TTL:-1ns Type:log Meta:map[] FileStateOS:16912651-51 IdentifierName:native} TimeSeries:false}
> 2020-10-06T12:38:49.724+0200	DEBUG	[harvester]	log/harvester.go:495	Drop line as it does not match any of the include patterns 
> 2020-10-06T12:38:49.724+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
> 2020-10-06T12:38:49.724+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
> 2020-10-06T12:38:49.724+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
> 2020-10-06T12:38:49.724+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
> 2020-10-06T12:38:49.724+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
> 2020-10-06T12:38:49.724+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
> 2020-10-06T12:38:49.724+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
> 
> ```

Processing 1 events

> ```
> 2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
> 2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
> 2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
> 2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
> 2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
> 2020-10-06T12:38:49.725+0200	DEBUG	[publisher]	pipeline/client.go:221	Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16912651-51 PrevId: Finished:false Fileinfo:0xc000605e10 Source:/home/anthony/TFG/archivos/twomore/packs.json Offset:10846 Timestamp:2020-10-06 12:38:49.723129635 +0200 CEST m=+0.486401212 TTL:-1ns Type:log Meta:map[] FileStateOS:16912651-51 IdentifierName:native} TimeSeries:false}
> 2020-10-06T12:38:49.725+0200	DEBUG	[harvester]	log/harvester.go:495	Drop line as it does not match any of the include patterns 
> 2020-10-06T12:38:49.725+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
> 2020-10-06T12:38:49.725+0200	DEBUG	[publisher]	pipeline/client.go:221	Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16912651-51 PrevId: Finished:false Fileinfo:0xc000605e10 Source:/home/anthony/TFG/archivos/twomore/packs.json Offset:18376 Timestamp:2020-10-06 12:38:49.723129635 +0200 CEST m=+0.486401212 TTL:-1ns Type:log Meta:map[] FileStateOS:16912651-51 IdentifierName:native} TimeSeries:false}
> 2020-10-06T12:38:49.725+0200	DEBUG	[harvester]	log/harvester.go:495	Drop line as it does not match any of the include patterns 
> 2020-10-06T12:38:49.725+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
> 2020-10-06T12:38:49.725+0200	DEBUG	[publisher]	pipeline/client.go:221	Pipeline client receives callback 'onFilteredOut' for event: {Timestamp:0001-01-01 00:00:00 +0000 UTC Meta:null Fields:null Private:{Id:native::16912651-51 PrevId: Finished:false Fileinfo:0xc000605e10 Source:/home/anthony/TFG/archivos/twomore/packs.json Offset:18438 Timestamp:2020-10-06 12:38:49.723129635 +0200 CEST m=+0.486401212 TTL:-1ns Type:log Meta:map[] FileStateOS:16912651-51 IdentifierName:native} TimeSeries:false}
> 2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
> 2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
> 2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
> 2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
> 2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
> 2020-10-06T12:38:49.725+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
> 2020-10-06T12:38:49.749+0200	DEBUG	[harvester]	log/harvester.go:495	Drop line as it does not match any of the include patterns 
> 2020-10-06T12:38:49.749+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
> 2020-10-06T12:38:49.749+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
> 2020-10-06T12:38:49.749+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
> 2020-10-06T12:38:49.749+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
> 2020-10-06T12:38:49.749+0200	DEBUG	[harvester]	log/harvester.go:495	Drop line as it does not match any of the include patterns 
> 2020-10-06T12:38:49.749+0200	DEBUG	[acker]	beater/acker.go:59	stateful ack	{"count": 1}
> 2020-10-06T12:38:49.749+0200	DEBUG	[registrar]	registrar/registrar.go:264	Processing 1 events
> 2020-10-06T12:38:49.749+0200	DEBUG	[registrar]	registrar/registrar.go:231	Registrar state updates processed. Count: 1
> 2020-10-06T12:38:49.749+0200	DEBUG	[registrar]	registrar/registrar.go:201	Registry file updated. 1 active states.
> 2020-10-06T12:38:49.749+0200	DEBUG	[harvester]	log/log.go:107	End of file reached: /home/anthony/TFG/archivos/twomore/packs.json; Backoff now.
> 
> ```

I tried to delete de data registry directory but logstash doesn't receive any data from filebeat.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 6, 2020, 2:36pm UTC](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636/6 "2020-10-06T14:36:30Z")

</div>

> [@AnthonyS4](#):
>
> ` include_lines: ["ip_ip"]`

Apparently the lines in the file do not include that, resulting in

> [@](#):
>
> log/harvester.go:495 Drop line as it does not match any of the include patterns

---

<div class="post-metadata">

**Author:** ![AnthonyS4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anthonys4/32/45312_2.png) [@AnthonyS4](https://discuss.elastic.co/u/AnthonyS4)\
**Post date:** [October 6, 2020, 2:59pm UTC](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636/7 "2020-10-06T14:59:51Z")

</div>

This is my input(4 first lines):

```
{"index":{"_index":"packets-2020-01-29","_type":"pcap_file"}}
{"timestamp":"1580316489257","layers":{"frame":{"frame_frame_interface_id":"0","frame_interface_id_frame_interface_name":"wlo1","frame_frame_encap_type":"1","frame_frame_time":"Jan 29, 2020 17:48:09.257671124 CET","frame_frame_offset_shift":"0.000000000","frame_frame_time_epoch":"1580316489.257671124","frame_frame_time_delta":"0.000000000","frame_frame_time_delta_displayed":"0.000000000","frame_frame_time_relative":"0.000000000","frame_frame_number":"1","frame_frame_len":"1514","frame_frame_cap_len":"1514","frame_frame_marked":"0","frame_frame_ignored":"0","frame_frame_protocols":"eth:ethertype:ip:tcp:tls"},"eth":{"eth_eth_dst":"00:23:15:ec:d3:58","eth_dst_eth_dst_resolved":"IntelCor_ec:d3:58","eth_dst_eth_addr":"00:23:15:ec:d3:58","eth_dst_eth_addr_resolved":"IntelCor_ec:d3:58","eth_dst_eth_lg":"0","eth_dst_eth_ig":"0","eth_eth_src":"30:7c:5e:a9:e3:00","eth_src_eth_src_resolved":"JuniperN_a9:e3:00","eth_src_eth_addr":"30:7c:5e:a9:e3:00","eth_src_eth_addr_resolved":"JuniperN_a9:e3:00","eth_src_eth_lg":"0","eth_src_eth_ig":"0","eth_eth_type":"0x00000800"},"ip":{"ip_ip_version":"4","ip_ip_hdr_len":"20","ip_ip_dsfield":"0x00000000","ip_dsfield_ip_dsfield_dscp":"0","ip_dsfield_ip_dsfield_ecn":"0","ip_ip_len":"1500","ip_ip_id":"0x00000b21","ip_ip_flags":"0x00000000","ip_flags_ip_flags_rb":"0","ip_flags_ip_flags_df":"0","ip_flags_ip_flags_mf":"0","ip_ip_frag_offset":"0","ip_ip_ttl":"120","ip_ip_proto":"6","ip_ip_checksum":"0x0000709f","ip_ip_checksum_status":"2","ip_ip_src":"130.206.193.111","ip_ip_addr":["130.206.193.111","10.182.114.104"],"ip_ip_src_host":"130.206.193.111","ip_ip_host":["130.206.193.111","10.182.114.104"],"ip_ip_dst":"10.182.114.104","ip_ip_dst_host":"10.182.114.104"},"tcp":{"tcp_tcp_srcport":"443","tcp_tcp_dstport":"39024","tcp_tcp_port":["443","39024"],"tcp_tcp_stream":"0","tcp_tcp_len":"1448","tcp_tcp_seq":"1","tcp_tcp_nxtseq":"1449","tcp_tcp_ack":"1","tcp_tcp_hdr_len":"32","tcp_tcp_flags":"0x00000010","tcp_flags_tcp_flags_res":"0","tcp_flags_tcp_flags_ns":"0","tcp_flags_tcp_flags_cwr":"0","tcp_flags_tcp_flags_ecn":"0","tcp_flags_tcp_flags_urg":"0","tcp_flags_tcp_flags_ack":"1","tcp_flags_tcp_flags_push":"0","tcp_flags_tcp_flags_reset":"0","tcp_flags_tcp_flags_syn":"0","tcp_flags_tcp_flags_fin":"0","tcp_flags_tcp_flags_str":"·······A····","tcp_tcp_window_size_value":"404","tcp_tcp_window_size":"404","tcp_tcp_window_size_scalefactor":"-1","tcp_tcp_checksum":"0x00001485","tcp_tcp_checksum_status":"2","tcp_tcp_urgent_pointer":"0","tcp_tcp_options":"01:01:08:0a:3d:e1:09:6e:e5:3a:c6:b9","tcp_options_tcp_options_nop":["01","01"],"tcp_options_nop_tcp_option_kind":["1","1"],"tcp_options_tcp_options_timestamp":"08:0a:3d:e1:09:6e:e5:3a:c6:b9","tcp_options_timestamp_tcp_option_kind":"8","tcp_options_timestamp_tcp_option_len":"10","tcp_options_timestamp_tcp_options_timestamp_tsval":"1038158190","tcp_options_timestamp_tcp_options_timestamp_tsecr":"3845834425","tcp_tcp_analysis":null,"tcp_analysis_tcp_analysis_bytes_in_flight":"1448","tcp_analysis_tcp_analysis_push_bytes_sent":"1448","tcp_text":"Timestamps","text_tcp_time_relative":"0.000000000","text_tcp_time_delta":"0.000000000","tcp_tcp_payload":"ff:e0:a1:96:ff:44:c5:98:5a:b9:28:2b:13:70:3a:6f:19:f2:d5:a8:f8:ec:80:98:70:82:aa:35:bc:b4:6d:23:9c:98:dc:5f:02:23:7a:1b:e8:4a:8d:c1:d6:16:a1:0b:d5:c5:26:29:7d:40:a9:f9:39:60:ab:ad:f5:de:36:09:b6:9c:f8:32:69:1c:ef:ac:84:af:16:72:dd:bd:e4:81:37:a5:4f:7a:ea:4e:6d:58:40:ba:24:a7:d9:00:cf:40:25:6f:f7:45:70:92:64:a8:d1:1a:1d:84:82:17:08:be:66:75:d3:a8:1d:b5:d8:6b:4a:5f:26:3e:78:55:6a:fb:ab:ff:db:62:71:bb:4b:29:9d:bb:7b:55:09:00:ed:e8:52:8f:75:2e:85:49:56:51:46:f7:5c:c8:7b:47:e9:5a:1c:ef:57:19:ec:fc:33:7f:a8:fc:04:f5:41:04:4d:7a:14:28:06:f3:9b:70:a5:6e:ea:c3:a9:7b:ea:5e:f4:20:90:c2:e7:ee:30:7c:18:50:83:22:ff:79:dd:17:79:10:f6:60:84:a1:ec:00:2c:32:f2:ba:5d:eb:40:14:71:23:c1:6e:f1:d2:41:f3:37:9a:cb:17:51:03:90:5d:2e:88:95:0b:6c:88:df:6c:ab:db:6f:a5:9a:d8:1b:4e:b2:cf:1f:23:10:03:3a:30:e5:8a:89:a7:e3:49:6d:69:24:fd:2d:32:6e:eb:84:7b:e6:66:5f:b7:d9:63:28:49:5f:33:13:8e:7e:79:79:ca:49:50:ef:08:f3:b8:33:dd:31:25:72:e6:df:c6:c6:9e:36:af:21:84:f2:d5:82:d7:13:07:8b:8b:e3:41:9a:20:5d:dc:e5:ef:29:d8:93:3b:95:07:60:b3:d2:76:1f:31:28:bf:97:06:60:07:1b:a6:11:90:c6:7e:6d:dd:b5:fa:02:13:7c:2d:5f:fc:98:22:a2:41:f8:9c:57:dd:84:f5:b1:41:d8:5f:41:d7:f2:37:ea:e8:e2:6d:0b:7b:76:de:36:bc:51:86:26:80:e4:33:1f:bf:82:24:1d:1b:c8:a3:07:29:3a:19:c3:47:3e:e2:87:9f:28:c2:a1:65:c1:b1:4b:1d:b2:b0:d3:22:85:7d:c0:67:ab:8c:7f:e9:c1:40:00:ae:f4:d8:81:57:dd:86:8e:b7:89:f3:5f:99:99:17:8f:de:9f:44:cb:08:ff:ff:23:b6:05:ca:83:a7:f0:bc:b0:6b:02:ae:fc:a9:fa:d6:90:85:31:b1:fb:4d:a4:12:7f:37:0b:35:20:5b:48:db:ee:7f:80:77:0a:6a:60:ad:71:f9:69:9d:c8:3b:51:9c:5d:61:40:d9:6e:6f:6b:5b:e6:f5:5e:bd:fa:8a:55:b6:bb:1f:ec:bf:1b:12:da:c6:e2:57:d6:d4:f5:69:c1:6b:5d:a3:da:a4:41:5f:e2:e3:63:e0:68:bc:f7:e1:ea:71:6d:a5:2a:03:62:e2:a7:3d:ac:92:d5:88:28:79:79:94:8d:63:cd:8d:f8:52:18:18:50:ff:61:7c:11:77:55:c6:12:94:53:37:38:48:bf:60:af:6e:2d:8a:c8:ac:3c:52:f3:12:4d:50:88:6c:e9:c9:2d:0a:4c:dc:a3:f4:a0:7d:77:ba:18:93:d2:91:3e:76:1d:67:b3:9f:86:73:4e:89:c9:bf:46:60:d8:ee:1f:57:01:24:ea:3f:f2:b3:43:c7:3b:ab:40:6c:46:0c:65:65:23:b4:b2:ac:49:62:0e:0a:12:7b:1b:e2:ca:5b:d9:87:36:36:06:1c:39:3e:21:f7:95:18:e9:7e:bd:58:9b:f6:e9:5b:05:8e:8a:cf:ba:32:63:f2:09:e8:fb:89:ef:62:db:05:20:10:99:ec:4c:1d:75:13:cf:25:fb:04:b1:ee:9a:0f:35:07:94:22:a5:e9:10:2a:62:5d:f8:ff:f8:c6:34:6b:a2:de:25:ae:a3:d7:42:a1:e9:fe:7f:6d:36:4d:c8:3d:95:70:46:81:55:ba:c2:21:af:eb:23:ce:ae:57:71:38:a6:62:a4:07:38:43:bd:ca:19:12:56:ef:29:5d:51:3d:c8:df:ce:ce:93:15:3c:b1:e2:4b:41:d7:40:4b:77:fc:c8:dd:d6:d7:ce:75:e9:07:05:b9:40:f9:4f:a4:92:0b:ec:64:25:58:82:2f:31:b8:15:26:48:88:f6:0a:24:a1:58:86:5f:67:06:d6:93:20:54:21:26:77:ba:0b:3d:52:9a:59:a1:5b:b3:35:8f:15:2d:22:b6:d4:47:52:2d:41:4d:80:ee:ed:5c:3f:49:5d:c2:4e:88:77:96:28:0e:d2:c4:42:44:02:7f:18:77:46:e0:27:f8:87:f2:68:14:cd:b0:45:d0:5a:f0:75:aa:bb:64:f0:1b:bb:c1:a6:64:6c:0b:1e:c5:7e:30:d8:64:78:e9:f4:a6:50:72:45:d4:53:df:c7:69:c2:9e:b7:3b:f6:a4:6a:51:09:05:16:53:96:a6:5e:27:50:2b:6f:07:dd:65:ac:e0:de:ee:1f:0e:3c:b3:37:ba:cd:6c:ac:94:28:d0:55:9f:5c:94:9c:b9:9f:35:7f:c7:78:91:f9:47:16:b5:60:a1:35:e3:c0:74:57:44:ef:e1:fc:93:2c:f4:8f:f7:ba:0d:06:c2:c4:54:71:a5:08:1e:dc:da:ad:89:ee:23:55:05:57:c7:30:75:b3:53:78:b3:3e:2c:b5:d9:04:57:92:37:dd:6c:a2:b1:4e:60:24:f1:cb:9f:fc:d9:25:cc:df:a8:f4:6a:74:72:e8:42:90:b4:f9:08:99:d5:56:78:7c:5c:77:92:4a:e9:65:cc:5d:17:f0:cf:7a:d1:66:68:d1:ad:d4:f1:26:a1:94:49:36:ad:87:c9:86:78:0b:6f:32:cf:b3:72:a0:ee:14:7f:28:e5:01:f5:93:b6:b0:85:85:dd:15:73:0f:f8:2b:08:fd:3d:1d:c3:2b:49:4a:27:bd:6f:dc:2a:bd:44:2a:31:9e:60:b1:b6:f6:e3:2f:11:b6:98:4b:fc:75:d1:84:0f:b8:72:8f:22:c0:d5:7b:83:74:95:69:d3:25:56:ad:c0:95:dd:05:86:13:fd:6a:ee:de:7d:28:e9:1b:80:70:c2:7a:98:50:10:08:39:33:36:08:4e:d8:7b:f6:86:ce:d9:e6:38:e0:49:38:d9:6f:82:f9:10:dc:4a:54:21:98:20:c4:ba:95:3e:7c:ca:47:dc:7c:51:bf:74:39:3c:0e:46:f3:03:44:57:49:ee:6b:26:9f:51:91:71:04:55:f4:c7:96:34:be:2e:a1:9e:09:17:78:7f:90:8d:dc:17:bd:a9:8a:c6:ea:23:8f:f1:ac:28:a9:21:13:b9:7e:15:63:c9:e5:02:2d:23:e5:d0:3b:03:d2:ab:24:ed:b1:7d:c2:7d:59:0b:1f:b6:ea:2b:03:e2:27:27:8f:17:26:ad:3e:0c:33:e0:ca:0f:f2:81:14:64:bf:32:6f:82:57:e3:b8:39:75:e4:12:53:66:9f:94:b2:72:8e:07:16:6b:1f:f6:02:97:e5:f5:77:11:9b:a0:c0:eb:30:91:ef:c7:d4:70:c1:9a:f1:09:84:d5:e1:d7:4a:1c:90:2e:c3:8f:16:d5:c1:e6:95:e2:6e:56:a7:45:13:18:2e:4f:74:10:4d:72:c2:84:0e:4c:00:86:48:4b:eb:13:31:6b:b8:13:1a:83:ae:cb:fb:35:d5:bb:cb:8b:cc:5e:6e:96:23:ac:8f:97:df:ae:37:93:9b:09:45:b6:74:6b:bd:23:42:e9:e4:ff"},"tls":{}}}
{"index":{"_index":"packets-2020-01-29","_type":"pcap_file"}}
{"timestamp":"1580316489257","layers":{"frame":{"frame_frame_interface_id":"0","frame_interface_id_frame_interface_name":"wlo1","frame_frame_encap_type":"1","frame_frame_time":"Jan 29, 2020 17:48:09.257724230 CET","frame_frame_offset_shift":"0.000000000","frame_frame_time_epoch":"1580316489.257724230","frame_frame_time_delta":"0.000053106","frame_frame_time_delta_displayed":"0.000053106","frame_frame_time_relative":"0.000053106","frame_frame_number":"2","frame_frame_len":"66","frame_frame_cap_len":"66","frame_frame_marked":"0","frame_frame_ignored":"0","frame_frame_protocols":"eth:ethertype:ip:tcp"},"eth":{"eth_eth_dst":"30:7c:5e:a9:e3:00","eth_dst_eth_dst_resolved":"JuniperN_a9:e3:00","eth_dst_eth_addr":"30:7c:5e:a9:e3:00","eth_dst_eth_addr_resolved":"JuniperN_a9:e3:00","eth_dst_eth_lg":"0","eth_dst_eth_ig":"0","eth_eth_src":"00:23:15:ec:d3:58","eth_src_eth_src_resolved":"IntelCor_ec:d3:58","eth_src_eth_addr":"00:23:15:ec:d3:58","eth_src_eth_addr_resolved":"IntelCor_ec:d3:58","eth_src_eth_lg":"0","eth_src_eth_ig":"0","eth_eth_type":"0x00000800"},"ip":{"ip_ip_version":"4","ip_ip_hdr_len":"20","ip_ip_dsfield":"0x00000000","ip_dsfield_ip_dsfield_dscp":"0","ip_dsfield_ip_dsfield_ecn":"0","ip_ip_len":"52","ip_ip_id":"0x0000e82b","ip_ip_flags":"0x00004000","ip_flags_ip_flags_rb":"0","ip_flags_ip_flags_df":"1","ip_flags_ip_flags_mf":"0","ip_ip_frag_offset":"0","ip_ip_ttl":"64","ip_ip_proto":"6","ip_ip_checksum":"0x0000913c","ip_ip_checksum_status":"2","ip_ip_src":"10.182.114.104","ip_ip_addr":["10.182.114.104","130.206.193.111"],"ip_ip_src_host":"10.182.114.104","ip_ip_host":["10.182.114.104","130.206.193.111"],"ip_ip_dst":"130.206.193.111","ip_ip_dst_host":"130.206.193.111"},"tcp":{"tcp_tcp_srcport":"39024","tcp_tcp_dstport":"443","tcp_tcp_port":["39024","443"],"tcp_tcp_stream":"0","tcp_tcp_len":"0","tcp_tcp_seq":"1","tcp_tcp_nxtseq":"1","tcp_tcp_ack":"1449","tcp_tcp_hdr_len":"32","tcp_tcp_flags":"0x00000010","tcp_flags_tcp_flags_res":"0","tcp_flags_tcp_flags_ns":"0","tcp_flags_tcp_flags_cwr":"0","tcp_flags_tcp_flags_ecn":"0","tcp_flags_tcp_flags_urg":"0","tcp_flags_tcp_flags_ack":"1","tcp_flags_tcp_flags_push":"0","tcp_flags_tcp_flags_reset":"0","tcp_flags_tcp_flags_syn":"0","tcp_flags_tcp_flags_fin":"0","tcp_flags_tcp_flags_str":"·······A····","tcp_tcp_window_size_value":"7720","tcp_tcp_window_size":"7720","tcp_tcp_window_size_scalefactor":"-1","tcp_tcp_checksum":"0x0000a841","tcp_tcp_checksum_status":"2","tcp_tcp_urgent_pointer":"0","tcp_tcp_options":"01:01:08:0a:e5:3a:c6:ec:3d:e1:09:6e","tcp_options_tcp_options_nop":["01","01"],"tcp_options_nop_tcp_option_kind":["1","1"],"tcp_options_tcp_options_timestamp":"08:0a:e5:3a:c6:ec:3d:e1:09:6e","tcp_options_timestamp_tcp_option_kind":"8","tcp_options_timestamp_tcp_option_len":"10","tcp_options_timestamp_tcp_options_timestamp_tsval":"3845834476","tcp_options_timestamp_tcp_options_timestamp_tsecr":"1038158190","tcp_tcp_analysis":null,"tcp_analysis_tcp_analysis_acks_frame":"1","tcp_analysis_tcp_analysis_ack_rtt":"0.000053106","tcp_text":"Timestamps","text_tcp_time_relative":"0.000053106","text_tcp_time_delta":"0.000053106"}}}

```

I'm trying to include the line 2, 4, 6, .... these lines has a field "ip\_ip\_addr" that is why I wrote that pattern.  
I bet there is a better way for do that but I'm a begginer with these tools...

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2020, 2:59pm UTC](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636/8 "2020-11-03T14:59:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.