# New to ES - Want to use Kibana to search JSON message fields

**URL:** <https://discuss.elastic.co/t/new-to-es-want-to-use-kibana-to-search-json-message-fields/14191>\
**Category:** Elasticsearch\
**Created:** [October 31, 2013, 4:05pm UTC](https://discuss.elastic.co/t/new-to-es-want-to-use-kibana-to-search-json-message-fields/14191 "2013-10-31T16:05:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_5](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@John\_5](https://discuss.elastic.co/u/John_5)\
**Post date:** [October 31, 2013, 4:05pm UTC](https://discuss.elastic.co/t/new-to-es-want-to-use-kibana-to-search-json-message-fields/14191/1 "2013-10-31T16:05:23Z")

</div>

I'm trying to use ElasticSearch & Kibana to drill into JSON message logs,  
but the only Fields I can see or search on are:  
@timestamp  
@version  
message

"message" is a string in JSON format that contains various data fields that  
I want to be able to search on, for example:  
{"ClientSubSystem":"Indexer", "CodeVersion":"13.4.03",  
"SessionDuration\_seconds":145.23, "DataLoadsAttempted":15,  
"BytesLoaded":125846713}

The actual number of fields may vary depending on the message - there will  
be a core set of common fields in all messages, and then a possible set of  
additional fields that will vary depending on the particular analysis needs  
of the subsystem developers. I'm hoping to allow for complex JSON messages,  
if possible. (Nested JSON objects, arrays, values of different types, etc.)

I'm using Logstash to feed ElasticSearch, and suspect I need to correctly  
set up some kind of templates, mappings, etc., but nothing I've tried  
allows me to drill into the message JSON fields using Kibana.

Can anyone provide any hints?

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:09am UTC](https://discuss.elastic.co/t/new-to-es-want-to-use-kibana-to-search-json-message-fields/14191/2 "2017-07-06T02:09:35Z")

</div>