# Need help to get Key Value into Elastic **URL:** \ **Category:** Logstash\ **Created:** [June 7, 2018, 4:03am UTC](https://discuss.elastic.co/t/need-help-to-get-key-value-into-elastic/134882 "2018-06-07T04:03:48Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![paano](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@paano](https://discuss.elastic.co/u/paano)\ **Post date:** [June 7, 2018, 4:03am UTC](https://discuss.elastic.co/t/need-help-to-get-key-value-into-elastic/134882/1 "2018-06-07T04:03:48Z")
ELK version 6.2.3 Sample data as below `{'_links': {'doc': {'href': '/mgmt/docs/status/MQSystemResources'}, 'self': {'href': '/mgmt/status/default/MQSystemResources'}}, 'MQSystemResources': {'HAStatus': 'Online', 'TotalErrorsStorage': 16179, 'UsedStorage': 528408, 'UsedErrorsStorage': 495, 'TotalTraceStorage': 32256, 'UsedTraceStorage': 691, 'TotalStorage': 3051008, 'HAPartner': 'MQA1 (Online)'}}` Logstash config has a Input Beats and Output section. Expectation is to have the Keys defined in ES\< and searchable in kibana. When looking in kibana, it is only a message field. stdout from logstash looks as ``` { "@timestamp" => 2018-06-07T05:01:56.544Z, "prospector" => { "type" => "log" }, "message" => "{'_links': {'doc': {'href': '/mgmt/docs/status/MQSystemResources'}, 'self': {'href': '/mgmt/status/default/MQSystemResources'}}, 'MQSystemResources': {'HAStatus': 'Online', 'TotalErrorsStorage': 16179, 'UsedStorage': 528408, 'UsedErrorsStorage': 495, 'TotalTraceStorage': 32256, 'UsedTraceStorage': 691, 'TotalStorage': 3051008, 'HAPartner': 'MQA1 (Online)'}}", "@version" => "1", "source" => "/var/log/om.log", "offset" => 363, "fields" => { "topic" => "dummy", "logsource" => "dummy" }, "beat" => { "hostname" => "elk", "version" => "6.2.3", "name" => "elk" } ``` } How do i have the Key values in ES indexed. ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [June 7, 2018, 5:12am UTC](https://discuss.elastic.co/t/need-help-to-get-key-value-into-elastic/134882/2 "2018-06-07T05:12:16Z")
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html) ---
**Author:** ![paano](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@paano](https://discuss.elastic.co/u/paano)\ **Post date:** [June 7, 2018, 2:10pm UTC](https://discuss.elastic.co/t/need-help-to-get-key-value-into-elastic/134882/3 "2018-06-07T14:10:16Z")
@rcowart I have tried that, and it did not work. Any other option to parse. ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [June 7, 2018, 2:22pm UTC](https://discuss.elastic.co/t/need-help-to-get-key-value-into-elastic/134882/4 "2018-06-07T14:22:52Z")
Exactly what did you try? Exactly what were the results? ---
**Author:** ![paano](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@paano](https://discuss.elastic.co/u/paano)\ **Post date:** [June 7, 2018, 2:42pm UTC](https://discuss.elastic.co/t/need-help-to-get-key-value-into-elastic/134882/5 "2018-06-07T14:42:18Z")
@rcowart as the message is JSON already, i tried adding and removing the "json" filter, but no luck. Filebeat configuration is as below: **filebeat config** filebeat.prospectors: - type: log enabled: true paths: output.logstash: hosts: ["logstash:5000"] **Logstash pipeline** ` input { beats { port =\> 5000 } } filter { json { source =\> "[message]" } } output { elasticsearch { hosts =\> "elasticsearch:9200" index =\> "dev-%{+YYYY.MM.dd}" } stdout { codec =\> rubydebug } } ` logstash "stdout" output is below. ` elk\_logstash | { elk\_logstash | "message" =\> "{'\_links': {'doc': {'href': '/mgmt/docs/status/MQSystemResources'}, 'self': {'href': '/mgmt/status/default/MQSystemResources'}}, 'MQSystemResources': {'HAStatus': 'Online', 'TotalErrorsStorage': 16179, 'UsedStorage': 528408, 'UsedErrorsStorage': 495, 'TotalTraceStorage': 32256, 'UsedTraceStorage': 691, 'TotalStorage': 3051008, 'HAPartner': 'MQA1 (Online)'}}", elk\_logstash | "@version" =\> "1", elk\_logstash | "fields" =\> { elk\_logstash | "logsource" =\> "mq\_event" elk\_logstash | }, elk\_logstash | "tags" =\> [ elk\_logstash | [0] "beats\_input\_codec\_plain\_applied", elk\_logstash | [1] "\_jsonparsefailure" elk\_logstash | ], elk\_logstash | "@timestamp" =\> 2018-06-07T14:36:31.495Z, elk\_logstash | "prospector" =\> { elk\_logstash | "type" =\> "log" elk\_logstash | }, elk\_logstash | "host" =\> "58b63133dc90", elk\_logstash | "beat" =\> { elk\_logstash | "name" =\> "58b63133dc90", elk\_logstash | "version" =\> "6.2.4", elk\_logstash | "hostname" =\> "58b63133dc90" elk\_logstash | }, elk\_logstash | "source" =\> "/var/log/om.json", elk\_logstash | "offset" =\> 363 elk\_logstash | } ` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 7, 2018, 4:13pm UTC](https://discuss.elastic.co/t/need-help-to-get-key-value-into-elastic/134882/6 "2018-06-07T16:13:54Z")
The json filter does not like the single quotes. Try ``` mutate { gsub => ["message", "'", '"'] } ``` ---
**Author:** ![paano](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@paano](https://discuss.elastic.co/u/paano)\ **Post date:** [June 7, 2018, 4:17pm UTC](https://discuss.elastic.co/t/need-help-to-get-key-value-into-elastic/134882/7 "2018-06-07T16:17:31Z")
@Badger Thanks. This resolved my issue. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2018, 4:17pm UTC](https://discuss.elastic.co/t/need-help-to-get-key-value-into-elastic/134882/8 "2018-07-05T16:17:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.