# Json to grok pattern

**URL:** <https://discuss.elastic.co/t/json-to-grok-pattern/105242>\
**Category:** Logstash\
**Created:** [October 25, 2017, 12:25pm UTC](https://discuss.elastic.co/t/json-to-grok-pattern/105242 "2017-10-25T12:25:54Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 25, 2017, 12:25pm UTC](https://discuss.elastic.co/t/json-to-grok-pattern/105242/1 "2017-10-25T12:25:54Z")

</div>

Please asisst, how do i convert a json object to Grok Pattern

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 25, 2017, 2:04pm UTC](https://discuss.elastic.co/t/json-to-grok-pattern/105242/2 "2017-10-25T14:04:55Z")

</div>

What does that mean? Perhaps it'll be easier for you to explain if you give an example.

---

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 25, 2017, 6:11pm UTC](https://discuss.elastic.co/t/json-to-grok-pattern/105242/3 "2017-10-25T18:11:25Z")

</div>

```
I have a Json Log , i was trying to create a Grok Pattern.

please assist with this config using Filebeat -> Elasticsearch , My Json is not being decomposed.

filebeat.prospectors: 
  - 
    input_type: log
    json.add_error_key: true
    json.keys_under_root: true
    paths: 
      - message.log
output.elasticsearch: 
  hosts: 
    - "http://localhost:9200"
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 25, 2017, 7:51pm UTC](https://discuss.elastic.co/t/json-to-grok-pattern/105242/4 "2017-10-25T19:51:22Z")

</div>

Normally one doens't use a grok filter to process JSON logs; you use a json codec or json filter. Individual fields could of course still be processed with grok but that's another matter.

For Filebeat questions please ask in the Filebeat category.

---

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 25, 2017, 8:17pm UTC](https://discuss.elastic.co/t/json-to-grok-pattern/105242/5 "2017-10-25T20:17:56Z")

</div>

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2017, 8:17pm UTC](https://discuss.elastic.co/t/json-to-grok-pattern/105242/6 "2017-11-22T20:17:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.