# Nested Jason with Filebeat

**URL:** <https://discuss.elastic.co/t/nested-jason-with-filebeat/116930>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 24, 2018, 9:43pm UTC](https://discuss.elastic.co/t/nested-jason-with-filebeat/116930 "2018-01-24T21:43:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_U](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@Michael\_U](https://discuss.elastic.co/u/Michael_U)\
**Post date:** [January 24, 2018, 9:44pm UTC](https://discuss.elastic.co/t/nested-jason-with-filebeat/116930/1 "2018-01-24T21:44:00Z")

</div>

Dear all,  
recently I used [logz.io](http://logz.io) to do my logging.  
My log-entries are nested .net objects, that I serialize to Json using NLog.

With [logz.io](http://logz.io) it just works fine - I can model any log-message and it will show up as a nested JSON in Kibana.

Now I want to build this with my own ELK stack using filebeats sending directly to ES.

The first problem I run into is:  
Filebeats seems to have issues handling nested Json rows.

Sample Json as received by [logz.io](http://logz.io):

```auto
 "_source": {
    "level": "Info",
    "strategyContext": {
      "strategyTitle": "Strat1",
      "magicID": "123",
      "symbol": "Crypto",
      "vpid": "1"
    },
    "appName": "MFM_Live",
    "logger": "MFM.Trades",
    "message": "InstructionID: 123 Order opened 123",
    "logClass": "StrategyLog",
    "type": "nlog",
    "sequenceId": "2",
    "logAction": "Trading_L20_Order_Success",
    "tags": [
      "_logz_http_bulk_json_8070"
    ],
    "@timestamp": "2018-01-24T22:06:32.1576008+01:00",
    "trading_L20_Order_Success": {
      "orderID": "123",
      "instructionID": "123",
      "logLevel": 2,
      "logMessage": "InstructionID: 123 Order opened 123"
    }
  },

```

This I want to achieve with my own ELK stack - what do I need to do?

Thanks and regards

Michael

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 25, 2018, 4:59pm UTC](https://discuss.elastic.co/t/nested-jason-with-filebeat/116930/2 "2018-01-25T16:59:53Z")

</div>

> [@Michael\_U](#):
>
> This I want to achieve with my own ELK stack - what do I need to do?

I see how you would like the output to be, what's the input?

Please share the raw log lines that are being ingested by Filebeat.  
Please share the configuration you are using for Filebeat.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2018, 4:59pm UTC](https://discuss.elastic.co/t/nested-jason-with-filebeat/116930/3 "2018-02-22T16:59:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.