# Moving JSON inner field to root level **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 22, 2018, 1:55pm UTC](https://discuss.elastic.co/t/moving-json-inner-field-to-root-level/145565 "2018-08-22T13:55:25Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![mecavity](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mecavity/32/34703_2.png) [@mecavity](https://discuss.elastic.co/u/mecavity)\ **Post date:** [August 22, 2018, 1:55pm UTC](https://discuss.elastic.co/t/moving-json-inner-field-to-root-level/145565/1 "2018-08-22T13:55:25Z")
Hi, I'm using filebeats to send logs from docker instances to elasticsearch. The log I am receiving in elasticsearch has a field called `message` which is a JSON object of the actual log that came out of the container. How can I change it so that the fields inside `message` become root level fields (making filtering and reading on kibana easier). This is my input config so far: > filebeat.inputs: > > - type: docker > containers: > path: "/var/lib/docker/containers" > stream: "all" > ids: > - "\*" > json.keys\_under\_root: true > json.add\_error\_key: true Thank you. ---
**Author:** ![mecavity](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mecavity/32/34703_2.png) [@mecavity](https://discuss.elastic.co/u/mecavity)\ **Post date:** [August 23, 2018, 4:01pm UTC](https://discuss.elastic.co/t/moving-json-inner-field-to-root-level/145565/2 "2018-08-23T16:01:00Z")
Ended up using Logstash. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 20, 2018, 4:01pm UTC](https://discuss.elastic.co/t/moving-json-inner-field-to-root-level/145565/3 "2018-09-20T16:01:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.