# Obtener un json de una entrada de log

**URL:** <https://discuss.elastic.co/t/obtener-un-json-de-una-entrada-de-log/166217>\
**Category:** Logstash\
**Created:** [January 29, 2019, 5:34pm UTC](https://discuss.elastic.co/t/obtener-un-json-de-una-entrada-de-log/166217 "2019-01-29T17:34:40Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lucas\_Fernandez](https://avatars.discourse-cdn.com/v4/letter/l/54ee81/32.png) [@Lucas\_Fernandez](https://discuss.elastic.co/u/Lucas_Fernandez)\
**Post date:** [January 29, 2019, 5:34pm UTC](https://discuss.elastic.co/t/obtener-un-json-de-una-entrada-de-log/166217/1 "2019-01-29T17:34:41Z")

</div>

Buenas!! necesitaria poder obtener un json de una entrada de log y poder convertir los campos de ese json a campos queryables (cabe destacar que esos campos pueden estar desordenados) en kibana a traves de elasticsearch.

este es mi logstash.conf actual.

input {  
beats {  
port =\> 5044  
}  
}

filter {  
grok {  
match =\> {  
"message" =\> "{contrato:%{INT:contrato:int}}"  
}  
}  
}

output {  
elasticsearch {  
hosts =\> ["elasticsearch:9200"]  
index =\> "logstash"  
}  
stdout {  
codec =\> json  
}  
}

Mi entrada de log es este:

DEBUG [2019-01-25 18:18:35,973] db679d09-66d1-4556-90d0-6174dc4b90ce a.c.e.s.j.c.JudicialidadService [dw-21 - GET /siniestros?expedientes=254472] {contrato:12345,tipo\_documento:DNI,numero\_documento:99999999}

pero tambien puede venir asi:

DEBUG [2019-01-25 18:18:35,973] db679d09-66d1-4556-90d0-6174dc4b90ce a.c.e.s.j.c.JudicialidadService [dw-21 - GET /siniestros?expedientes=254472] {contrato:12345,numero\_documento:99999999,tipo\_documento:DNI}

en ambos casos hay que convertir los campos del json en campos del documento que se grabe en elasticsearch.

Gracias!!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 29, 2019, 5:52pm UTC](https://discuss.elastic.co/t/obtener-un-json-de-una-entrada-de-log/166217/2 "2019-01-29T17:52:14Z")

</div>

You might want to move this to [Elastic en espanol](https://discuss.elastic.co/c/in-your-native-tongue/elastic-en-espanol).

Or not. You can chop up those logs using dissect. Something like

```
dissect { mapping => { "message" => "%{level} [%{ts} %{+ts}] %{guid} %{class} [%{something}] %{json}" } }

```

If your JSON is valid (it does not appear that it is) then you can parse it using

```
filter { json { source => "json" } }

```

You may be able to fix your JSON using

```
mutate { gsub => ["json", "^{", '{"', "json", "}$", '"}', "json", ":", '":"', "json", ",", '","'] }
```

---

<div class="post-metadata">

**Author:** ![Lucas\_Fernandez](https://avatars.discourse-cdn.com/v4/letter/l/54ee81/32.png) [@Lucas\_Fernandez](https://discuss.elastic.co/u/Lucas_Fernandez)\
**Post date:** [January 29, 2019, 5:55pm UTC](https://discuss.elastic.co/t/obtener-un-json-de-una-entrada-de-log/166217/3 "2019-01-29T17:55:58Z")

</div>

This works to Logstash 6.5.4??

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 29, 2019, 6:06pm UTC](https://discuss.elastic.co/t/obtener-un-json-de-una-entrada-de-log/166217/4 "2019-01-29T18:06:21Z")

</div>

Yes. Can you show us what one of those events looks like when you add

```
 output { stdout { codec => rubydebug } }

```

to the end of your configuration? I want to see if the JSON fields are already quoted.

---

<div class="post-metadata">

**Author:** ![Lucas\_Fernandez](https://avatars.discourse-cdn.com/v4/letter/l/54ee81/32.png) [@Lucas\_Fernandez](https://discuss.elastic.co/u/Lucas_Fernandez)\
**Post date:** [January 29, 2019, 6:22pm UTC](https://discuss.elastic.co/t/obtener-un-json-de-una-entrada-de-log/166217/5 "2019-01-29T18:22:29Z")

</div>

This is the logstash.conf

input {  
beats {  
port =\> 5044  
}  
}

filter {  
dissect {  
mapping =\> {  
"message" =\> "%{level} [%{ts} %{+ts}] %{guid} %{class} [%{something}] %{json}"  
}  
}  
}

output {  
stdout {  
codec =\> rubydebug  
}  
elasticsearch {  
hosts =\> ["elasticsearch:9200"]  
index =\> "logstash"  
}

}

and this is the console output:

{  
"host" =\> {  
"name" =\> "4514e89c0134"  
},  
"class" =\> "a.c.e.s.j.c.JudicialidadService",  
"@timestamp" =\> 2019-01-29T18:18:01.522Z,  
"something" =\> "dw-21 - GET /siniestros?expedientes=254472",  
"source" =\> "/webapp/filebeat/webapp/LOGGER.log",  
"input" =\> {  
"type" =\> "log"  
},  
"level" =\> "DEBUG",  
"prospector" =\> {  
"type" =\> "log"  
},  
"ts" =\> "2019-01-25 18:18:35,973",  
"tags" =\> [  
[0] "beats\_input\_codec\_plain\_applied"  
],  
"message" =\> "DEBUG [2019-01-25 18:18:35,973] db679d09-66d1-4556-90d0-6174dc4b90ce a.c.e.s.j.c.JudicialidadService [dw-21 - GET /siniestros?expedientes=254472] {contrato:12345}",  
"@version" =\> "1",  
"offset" =\> 1956,  
"json" =\> "{contrato:12345}",  
"beat" =\> {  
"version" =\> "6.5.4",  
"hostname" =\> "4514e89c0134",  
"name" =\> "4514e89c0134"  
},  
"guid" =\> "db679d09-66d1-4556-90d0-6174dc4b90ce"  
}

Now i have to convert the fields of that json into queryable fields (these fields can be disordered) in kibana through elasticsearch.

Thank you!!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 29, 2019, 6:28pm UTC](https://discuss.elastic.co/t/obtener-un-json-de-una-entrada-de-log/166217/6 "2019-01-29T18:28:35Z")

</div>

> [@Lucas\_Fernandez](#):
>
> filter {  
> dissect {  
> mapping =\> {  
> "message" =\> "%{level} [%{ts} %{+ts}] %{guid} %{class} [%{something}] %{json}"  
> }  
> }  
> }

If you change that to

```
filter {
    dissect { mapping => { "message" => "%{level} [%{ts} %{+ts}] %{guid} %{class} [%{something}] %{json}" } }
    mutate { gsub => ["json", "^{", '{"', "json", "}$", '"}', "json", ":", '":"', "json", ",", '","'] }
    filter { json { source => "json" } }
}

```

then I would expect that to work. The mutate will convert {contrato:12345} into {"contrato":"12345"} and the json filter should work just fine on that.

---

<div class="post-metadata">

**Author:** ![Lucas\_Fernandez](https://avatars.discourse-cdn.com/v4/letter/l/54ee81/32.png) [@Lucas\_Fernandez](https://discuss.elastic.co/u/Lucas_Fernandez)\
**Post date:** [January 29, 2019, 6:34pm UTC](https://discuss.elastic.co/t/obtener-un-json-de-una-entrada-de-log/166217/7 "2019-01-29T18:34:45Z")

</div>

Sorry, how does gsub work? That's magic for me. jaja

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 29, 2019, 6:37pm UTC](https://discuss.elastic.co/t/obtener-un-json-de-una-entrada-de-log/166217/8 "2019-01-29T18:37:32Z")

</div>

There are 4 gsubs there. The first replaces { at the start of a line with {". The second replaces } at the end of a line with "}. The third changes : to ":". The fourth changes , to ","

---

<div class="post-metadata">

**Author:** ![Lucas\_Fernandez](https://avatars.discourse-cdn.com/v4/letter/l/54ee81/32.png) [@Lucas\_Fernandez](https://discuss.elastic.co/u/Lucas_Fernandez)\
**Post date:** [January 29, 2019, 6:43pm UTC](https://discuss.elastic.co/t/obtener-un-json-de-una-entrada-de-log/166217/9 "2019-01-29T18:43:57Z")

</div>

Thank you very much bro!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2019, 6:44pm UTC](https://discuss.elastic.co/t/obtener-un-json-de-una-entrada-de-log/166217/10 "2019-02-26T18:44:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.