# Json logfiles from Elastic Engineer I course not loaded into elasticsearch 7.0

**URL:** https://discuss.elastic.co/t/json-logfiles-from-elastic-engineer-i-course-not-loaded-into-elasticsearch-7-0/180888
**Category:** Beats
**Tags:** filebeat
**Created:** [May 13, 2019, 8:57pm UTC](https://discuss.elastic.co/t/json-logfiles-from-elastic-engineer-i-course-not-loaded-into-elasticsearch-7-0/180888 "2019-05-13T20:57:32Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Mark\_Busenhart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_busenhart/32/46108_2.png) [@Mark\_Busenhart](https://discuss.elastic.co/u/Mark_Busenhart)
#### Post date: [May 13, 2019, 8:57pm UTC](https://discuss.elastic.co/t/json-logfiles-from-elastic-engineer-i-course-not-loaded-into-elasticsearch-7-0/180888/1 "2019-05-13T20:57:32Z")

</div>

Didn't succeed to migrate my data from the elastic engineer I course to elasticsearch 7.0.

Input log:  
{"geoip":{"city\_name":"Holly Springs","country\_name":"United States","country\_code2":"US","continent\_code":"NA","country\_code3":"US","location":{"lon":-78.8786,"lat":35.6022},"region\_name":"North Carolina"},"status\_code":200,"method":"GET","level":"info","runtime\_ms":97,"http\_version":"1.1","language":{"url":"/blog/elasticsearch-5-3-0-released?utm\_source=dbweekly&utm\_medium=email","code":"en-us"},"originalUrl":"/blog/elasticsearch-5-3-0-released?utm\_source=dbweekly&utm\_medium=email","response\_size":49766,"@timestamp":"2017-03-31T23:47:27.564Z","host":"server1","user\_agent":"Amazon CloudFront"}

filebeat.yml:

filebeat.inputs:

- type: log  
enabled: true  
paths:
  - /path/data/elastic\_blog\_curated\_access\_logs\_server\*/\*.log  
json.keys\_under\_root: true  
json.overwrite\_keys: true

processors:

# - drop\_fields:

# fields: ["host.name"]

- decode\_json\_fields:  
fields: ["json"]  
process\_array: true  
target: ''  
overwrite\_keys: true

- drop\_fields:  
fields: ["log", "input", "ecs", "agent"]

setup.template.enabled: true  
setup.template.name: "logs-"  
setup.template.pattern: "logs-\*"  
setup.dashboards.enabled: false

#output.console.pretty: true

output.elasticsearch:  
hosts: ["localhost:9200"]  
username: elastic  
password: password  
index: "logs\_%{[host]}"  
bulk\_max\_size: 100

Result:

{  
"@timestamp": "2017-03-31T23:56:29.072Z",  
"@metadata": {  
"beat": "",  
"type": "\_doc",  
"version": ""  
},  
"geoip": {  
"continent\_code": "NA",  
"country\_code3": "US",  
"location": {  
"lon": -77.4728,  
"lat": 39.0481  
},  
"region\_name": "Virginia",  
"city\_name": "Ashburn",  
"country\_code2": "US",  
"country\_name": "United States"  
},  
"level": "info",  
"host": {  
"name": "mark-busenharts-imac-4.home"  
},  
"status\_code": 200,  
"runtime\_ms": 146,  
"language": {  
"url": "/blog/author/thom-o%27connor",  
"code": "en-us"  
},  
"response\_size": 45120,  
"method": "GET",  
"http\_version": "1.1",  
"user\_agent": "Amazon CloudFront",  
"originalUrl": "/blog/author/thom-o%27connor"  
}

which is pretty much what I want except for the host field that should be "server1". In my understanding the host value should be overwritten with overwrite\_keys: true. What am I missing.

Would be great if somebody could give me a hint on how to get the correct value in the host field.

Kind regards  
Mark

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 10, 2019, 8:57pm UTC](https://discuss.elastic.co/t/json-logfiles-from-elastic-engineer-i-course-not-loaded-into-elasticsearch-7-0/180888/2 "2019-06-10T20:57:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.