# Not able to convert json string to json object with filebeat TCP input

**URL:** <https://discuss.elastic.co/t/not-able-to-convert-json-string-to-json-object-with-filebeat-tcp-input/208179>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 16, 2019, 6:05pm UTC](https://discuss.elastic.co/t/not-able-to-convert-json-string-to-json-object-with-filebeat-tcp-input/208179 "2019-11-16T18:05:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vaseem](https://avatars.discourse-cdn.com/v4/letter/v/6f9a4e/32.png) [@vaseem](https://discuss.elastic.co/u/vaseem)\
**Post date:** [November 16, 2019, 6:05pm UTC](https://discuss.elastic.co/t/not-able-to-convert-json-string-to-json-object-with-filebeat-tcp-input/208179/1 "2019-11-16T18:05:14Z")

</div>

Hi All,

I am sending json string(For example {"key1": "value1", "key2":"value2"}) to filebeat-\>elasticsearch-\>kibana using TCP input in filebeat. However I am getting json string under message field on kibana/elasticsearch (for example "message": {"key1": "value1", "key2":"value2"}.

Note I am sending 1 json string(example given above) at a time with TCP stream

I have tried various option(and combination) in filebeat but nothing worked so far.

1. 
  - type: tcp  
host: "XXXXXX"  
enabled: true  
processors:
  - decode\_json\_fields:  
fields: ["message"]  
process\_array: true  
max\_depth: 1  
target: ""  
overwrite\_keys: false  
add\_error\_key: true

2. json.keys\_under\_root: true  
json.add\_error\_key: true

3. In elasticsearch output in filebeat.yml  
codec.json:  
pretty: true  
escape\_html: false

Could anyone please help me to solve this issue.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [November 18, 2019, 11:33am UTC](https://discuss.elastic.co/t/not-able-to-convert-json-string-to-json-object-with-filebeat-tcp-input/208179/2 "2019-11-18T11:33:09Z")

</div>

Could you please format your configuration using `</>`? Also, share the debug logs of Filebeat (`./filebeat -e -d "*"`).

---

<div class="post-metadata">

**Author:** ![vaseem](https://avatars.discourse-cdn.com/v4/letter/v/6f9a4e/32.png) [@vaseem](https://discuss.elastic.co/u/vaseem)\
**Post date:** [November 26, 2019, 6:35am UTC](https://discuss.elastic.co/t/not-able-to-convert-json-string-to-json-object-with-filebeat-tcp-input/208179/3 "2019-11-26T06:35:29Z")

</div>

I was able to resolve this by moving processor in global section

processors:

- add\_host\_metadata: ~
- add\_cloud\_metadata: ~
- decode\_json\_fields:  
fields: ["message"]  
process\_array: false  
max\_depth: 1  
target: ""  
overwrite\_keys: true  
add\_error\_key: true
- drop\_fields:  
fields: ["message","ecs","log","input","host","os","agent"]

---

<div class="post-metadata">

**Author:** ![vaseem](https://avatars.discourse-cdn.com/v4/letter/v/6f9a4e/32.png) [@vaseem](https://discuss.elastic.co/u/vaseem)\
**Post date:** [November 26, 2019, 6:37am UTC](https://discuss.elastic.co/t/not-able-to-convert-json-string-to-json-object-with-filebeat-tcp-input/208179/4 "2019-11-26T06:37:13Z")

</div>

However, the filebeat output file did not set the 777 permission.

below is the configuration:

output.file:  
path: "/home/opc/log"  
filename: filebeat  
permissions: 0777  
rotate\_every\_kb: 13312  
number\_of\_files: 2

Note I was able to set other permission like 0600, etc(but maximum permission i was able to set is 755).  
Below is the snapshot of files:  
-rwxr-xr-x. 1 root root 4210956 Nov 26 06:39 filebeat  
-rwxr-xr-x. 1 root root 13631350 Nov 26 06:39 filebeat.1  
-rwxr-xr-x. 1 root root 13631350 Nov 26 06:39 filebeat.2

Do you have any idea/inputs whether the filebeat behavior is correct or not? Because, in this case logstash is not able to delete file after reading the same as it was created by root and persmission for other and group user is R+X

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 24, 2019, 6:37am UTC](https://discuss.elastic.co/t/not-able-to-convert-json-string-to-json-object-with-filebeat-tcp-input/208179/5 "2019-12-24T06:37:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.