# Json forwarding (multiple fields)

**URL:** <https://discuss.elastic.co/t/json-forwarding-multiple-fields/190677>\
**Category:** Logstash\
**Created:** [July 16, 2019, 8:22am UTC](https://discuss.elastic.co/t/json-forwarding-multiple-fields/190677 "2019-07-16T08:22:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![JensVanDeynse](https://avatars.discourse-cdn.com/v4/letter/j/3d9bf3/32.png) [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\
**Post date:** [July 16, 2019, 8:22am UTC](https://discuss.elastic.co/t/json-forwarding-multiple-fields/190677/1 "2019-07-16T08:22:11Z")

</div>

Hello

I'm trying to set up json forwarding from our filebeats to our logstash which will eventually forward it to the correct index in ElasticSearch. For several logs this works but one specific one fails for us and it looks like this:

{"bytes":0,"@timestamp":"2019-07-16T09:00:09.6338049+02:00","httpVersion":"HTTP/1.1","requestUrl":"/api/actuator/health","responseTime":1,"sourceIp":"10.7.0.4","status":200,"tenant":null,"user":null,"userAgent":"HAProxy\_health\_check","verb":"GET","correlationId":"41208d77","extraProperties":{"BuildNumber":"1.0.0.0","SourceContext":"Test.Net.Common.Logging.Helpers.Middlewares.AccessLoggingMiddleware"}}

I've tested several scenarios and concluded that it fails due to the 'extraProperties' field, when I copy/paste a line and edit it in the same file it does get send to the correct index. But the above log line is a valid JSON so I don't get why it fails and it also doesn't show up as failed since we check for the '\_jsonparsefailure' tag in our logstash configuration.

The filebeat configuration looks as follows:

- type: log  
paths:
  - /var/log/test-session/access\*.log  
fields:  
env: qa  
server: cordocker01.qa.test.be  
app: tarification-session-access  
logstash\_template: access-logs  
fields\_under\_root: true  
json.keys\_under\_root: true  
json.add\_error\_key: true  
json.overwrite\_keys: true

Has anybody else experienced this issue or is this just not possible?

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2019, 8:22am UTC](https://discuss.elastic.co/t/json-forwarding-multiple-fields/190677/2 "2019-08-13T08:22:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.