Here is the config file for filebeat. I am basically mapping the fields from the json to the same field in fillebeat.
filebeat.prospectors:
- type: log
enabled: true
paths:
- /log/*.log
multiline.pattern: '^{'
multiline.negate: true
multiline.match: after
processors:
- decode_json_fields:
fields: ["timestamp", "message", "level"]
process_array: false
max_depth: 1
target: ""
overwrite_keys: true