# Logstash Filter JSON syslog message field is not getting parsed
**URL:** https://discuss.elastic.co/t/logstash-filter-json-syslog-message-field-is-not-getting-parsed/309864
**Category:** Logstash
**Created:** [July 18, 2022, 9:25am UTC](https://discuss.elastic.co/t/logstash-filter-json-syslog-message-field-is-not-getting-parsed/309864 "2022-07-18T09:25:09Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Giridharan\_C](https://discuss.elastic.co/u/Giridharan_C)
#### Post date: [July 18, 2022, 9:25am UTC](https://discuss.elastic.co/t/logstash-filter-json-syslog-message-field-is-not-getting-parsed/309864/1 "2022-07-18T09:25:09Z")
I cannot parse the incoming Syslog by JSON. The message field is not getting parsed. I tried JSON filter using addfield and also with mutate but no luck. I used GROK to parse specific fields but the message field has keys and values. How to parse the below message field into JSON
> Blockquote conf file
```auto
input {
file {
path => "/opt/log/sample/*.txt"
codec => "plain" # { format => "%{message}" }
}
}
filter {
# mutate { gsub => ["message","(\")", ""] }
mutate { gsub => ["message","(\\")", ""] }
json {
source => "message"
}
}
output {
file {
path => "/opt/log/out/out.txt"
codec => json_lines
}
stdout {}
}
```
GROK ` %{TIME:timestamp} %{HOST:host} %{GREEDYDATA:message}`
GROK output
```auto
"timestamp": [
[
"18:11:58"
]
],
"host": [
[
"myhost.aco.mydomain.net"
]
],
"message": [
[
"{destinationPort:90,exception:-,totalByteUsage:0,sourcePort:160,extension:.com\\\\/,contentTypeHeader:-,callout:0,scheme:http,reportingGroup:0,requestMethod:GET,privateIp:-,sAction:Allowed,sourceIpAddress:10.10.10.10,description:-,categoryName:News,sandBoxDecoded:-,urlLogId:0,responseCode:0,sandboxResult:-,computerName:-,totalByteCount:0,audit:0,host:www.local.com,action:Allowed,useTime:0,upstreamByteUsage:0,uriPath:\\\\/,computerMacAddress:00:00:00:00:00:00,direction:0,myboss:myhost,malware:0,ipAddress:10.10.10.10,userAgent:-,publicIp:-,url:http:\\\\/\\\\/www.local.com\\\\/,logTime:2022-07-12,referrerUrl:-,mde:-,sha256Sum:-,macAddress:00:00:00:00:00:00,filename:-,uriQuery:-,filteringGroupName:Default Catch All,downstreamByteUsage:0,cncFlag:0,location:-,time:18:11:57,username:*10.10.10.10}""
]
]
}
```
---
### Author:  [@sudhagar\_ramesh](https://discuss.elastic.co/u/sudhagar_ramesh)
#### Post date: [July 18, 2022, 3:30pm UTC](https://discuss.elastic.co/t/logstash-filter-json-syslog-message-field-is-not-getting-parsed/309864/2 "2022-07-18T15:30:53Z")
Hello @Giridharan_C
Welcome to Elastic Community 🙂
We have use to use Grok with KV filter. Hence, try the below
```auto
filter
{
grok
{
match => {"message" => "%{TIME:timestamp} %{DATA:host} {%{GREEDYDATA:messages}}"}
}
kv {
source => "messages"
field_split => ","
value_split => ":"
}
}
```
Keep posted on how it goes !!! Thanks
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 18, 2022, 4:14pm UTC](https://discuss.elastic.co/t/logstash-filter-json-syslog-message-field-is-not-getting-parsed/309864/3 "2022-07-18T16:14:31Z")
Use a kv filter to parse the message field.
```
mutate { gsub => ["message", "[{}]", "" ] }
kv { source => "message" field_split => "," value_split => ":" }
```
which will produce
```
"time" => "18:11:57",
"sandboxResult" => "-",
"cncFlag" => "0",
"reportingGroup" => "0",
"uriQuery" => "-",
...
```
---
### Author:  [@Giridharan\_C](https://discuss.elastic.co/u/Giridharan_C)
#### Post date: [July 18, 2022, 6:12pm UTC](https://discuss.elastic.co/t/logstash-filter-json-syslog-message-field-is-not-getting-parsed/309864/4 "2022-07-18T18:12:22Z")
Thanks @Badger @sudhagar_ramesh .
I can able to parse and extract the JSON fields.
Below is my filter
```auto
filter {
mutate { gsub => ["message","(\\")", ""]}
mutate { gsub => ["message", "[{}]", "" ] }
grok {
match => { "message" => "%{TIME:timestamp} %{GREEDYDATA:message_json}" }
}
kv { source => "message_json" field_split => "," value_split => ":" }
mutate {
rename => {"host" => "message_host"}
remove_field => ["message", "message_json"]
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 15, 2022, 6:12pm UTC](https://discuss.elastic.co/t/logstash-filter-json-syslog-message-field-is-not-getting-parsed/309864/5 "2022-08-15T18:12:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.