JSON logs not being converted in filebeat/logstash


(Shubham Mahajan) #1

{"@timestamp":"2017-08-15T21:30:03.776+00:00","@version":1,"message":"Registry invocation httpStatus: 401 ","logger_name":"invoker.CloudRegistryInvoker","thread_name":"http-nio-7010-exec-10","level":"INFO","level_value":20000,"HOSTNAME":"TANS28","CorrelationId":"eacca7b3e15e2fd","flowId":"READ_SEAT"}
{"@timestamp":"2017-08-15T21:30:03.776+00:00","@version":1,"message":"Registry - authorize: 9 ms","logger_name":"EXT_SYS_DURATION_LOGGER","thread_name":"http-nio-7010-exec-10","level":"INFO","level_value":20000,"HOSTNAME":"TANS28","CorrelationId":"eacc82d603e15e2fd","flowId":"WRITE_SEAT"}

these are the sample logs.

i need to get them as key value in Kibana through logstash and filebeat.

My logstash config:

input {
  beats {
     port => 5044
	 codec => "json_lines"
     tags => "JSON"
  }	
}

output {
  elasticsearch {
	hosts => ["http://localhost:9200"] 
	}
  stdout { }
}

My Filebeat.yml:

filebeat.prospectors:
- paths:
    - \Users\a871nmd\Desktop\ELK\logs\Management.log
  document_type: myapp
  json.keys_under_root: true
  json.add_error_key: true

output.logstash:
  hosts: ['localhost:5044']

But still getting logs like this in kibana:

Please help. Thanks in advance.


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.