# Log file to json

**URL:** <https://discuss.elastic.co/t/log-file-to-json/150526>\
**Category:** Logstash\
**Created:** [October 1, 2018, 8:00am UTC](https://discuss.elastic.co/t/log-file-to-json/150526 "2018-10-01T08:00:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![erkant](https://avatars.discourse-cdn.com/v4/letter/e/bcef8e/32.png) [@erkant](https://discuss.elastic.co/u/erkant)\
**Post date:** [October 1, 2018, 8:00am UTC](https://discuss.elastic.co/t/log-file-to-json/150526/1 "2018-10-01T08:00:48Z")

</div>

Hi,  
I installed elasticsearch-6.4.1, kibana-6.4.1, logstash-6.4.1 and filebeat.6-4.1

```auto
filebeat.yml
#=========================== Filebeat inputs =============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log
   

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - var/log/test/*.log

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["192.168.1.10:9200"]
  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"
 
-----------logstash.conf----------------
input {
  beats {
    port => 5044
  }
}
output {
  elasticsearch {
    hosts => ["192.168.1.10:9200"]
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

everything okey. when send message show kibana.

I have log file for example;  
09-11-2018 03:02 : DTC Install error = 0, InstallContacts, Exit, com\complus\dtc\dtc\adme\deployment.cpp (389)

I want show kibana;  
time:09-11-2018 03:02 DTC  
field1: install error = 0  
field2: InstallContacts  
field3: Exit  
fields4: com\complus\dtc\dtc\adme\deployment.cpp (389)

how can I do this?(to json )

ty for help

---

<div class="post-metadata">

**Author:** ![erkant](https://avatars.discourse-cdn.com/v4/letter/e/bcef8e/32.png) [@erkant](https://discuss.elastic.co/u/erkant)\
**Post date:** [October 2, 2018, 6:21am UTC](https://discuss.elastic.co/t/log-file-to-json/150526/2 "2018-10-02T06:21:50Z")

</div>

hi again!  
i change logstash.conf file but continous problem

```auto
---------------------logstash.conf-------------------------
input {
  beats {
    port => 5044 
  }
}
filter {
  grok { match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\]\[%{DATA:loglevel}%{SPACE}\]\[%{DATA:node}\s\]\s\[%{DATA:client}]\ %{GREEDYDATA:message}"}
}
}
output {
  elasticsearch {
    hosts => ["192.168.1.10:9200"]
    manage_template => false
    index => "%{[@metadata][beat]}"
   document_type => "%{[@metadata][json]}"
  }
}

```

 ![grok](https://us1.discourse-cdn.com/elastic/original/3X/1/f/1f44fa5bea75924cd581c1c38d8a5829cbcd77bb.png)  
kibana grok debugger result

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [October 2, 2018, 7:19am UTC](https://discuss.elastic.co/t/log-file-to-json/150526/3 "2018-10-02T07:19:23Z")

</div>

You are sending your data directly to elasticsearch so it does not matter what filter you have in logstash, it will never be used. Inside filebeat setup a logstash output.

---

<div class="post-metadata">

**Author:** ![erkant](https://avatars.discourse-cdn.com/v4/letter/e/bcef8e/32.png) [@erkant](https://discuss.elastic.co/u/erkant)\
**Post date:** [October 2, 2018, 10:16am UTC](https://discuss.elastic.co/t/log-file-to-json/150526/4 "2018-10-02T10:16:58Z")

</div>

thank you so much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 30, 2018, 10:16am UTC](https://discuss.elastic.co/t/log-file-to-json/150526/5 "2018-10-30T10:16:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.