Logstash not parsing json from kafka

Elastic Stack Logstash
1

I have the below json message coming into logstash and entering with format indicated below into elasticsearch but unparsed even though i am using the json code. Please let me know if I'm missing something.

thanks

coming into logstash

"message" => "{ \"timestamp\": \"1558622557.826\", \"chain_id\": \"-\", \"message\": \"GET /service/event/status HTTP/1.1\", \"x-forwarded-for\": \"-\", \"x-forwarded-host\": \"-\", \"request\": { \"x_physiq_timespan\": \"-\", \"addr\": \"10.11.26.1\", \"user\": \"-\", \"size\": 152, \"method\": \"GET\", \"encoding\": \"-\", \"resource\": \"/service/event/status\", \"referrer\": \"-\", \"agent\": \"kube-probe/1.11+\" },\"response\": { \"size\": 296, \"status\": 200, \"time\": 0.007  }}"

Entering into elasticsearch

{ "timestamp": "1558647226.135", "chain_id": "-", "message": "GET /service/event/status HTTP/1.1", "x-forwarded-for": "-", "x-forwarded-host": "-", "request": { "x_physiq_timespan": "-", "addr": "10.11.42.1", "user": "-", "size": 153, "method": "GET", "encoding": "-", "resource": "/service/event/status", "referrer": "-", "agent": "kube-probe/1.11+" },"response": { "size": 296, "status": 200, "time": 0.006  }}

and the following codec I'm using for logstash

input {
  kafka {
    bootstrap_servers => "kafka-0.kafka-svc.logging:9092"
    codec => "json"
    topics => "logstash"
    auto_offset_reset => "earliest"
    decorate_events => true
  }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.