I'm learning logstash and I'm using Kibana to see the logs. I would like to know if is there anyway to add fields using data from message property. For example, the log is like this: port:46,722 host:172.18.0.5 message:{"@timestamp":"2016-12-28T00:34:53.198+00:00","@version":1,"message":"Entrada d…

Do not parse JSON strings with grok filters. Either change your input's codec to json or json_lines or use a json filter to parse the message field.

Discuss the Elastic Stack

Logstash - Add fields from the log fields property - Grok

Elastic Stack Logstash

AleGallagher (ALe) January 3, 2017, 1:03pm 3

It works! Thank you very much!

Topic		Replies	Views
Turn messages into fields - querying in kibana Logstash	8	1214	July 6, 2017
Log4j in integration with logstash Logstash	5	930	July 6, 2017
Logstash adds fields to JSON by parsing another field Logstash	3	951	May 26, 2017
Parsing data from the message field of incoming json Logstash	2	645	September 14, 2017
Not displaying fields specified in the Logstash filter Logstash	11	4729	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Logstash - Add fields from the log fields property - Grok

Related topics