# One line JSON parsing into separate events/logs

**URL:** <https://discuss.elastic.co/t/one-line-json-parsing-into-separate-events-logs/191074>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 17, 2019, 6:56pm UTC](https://discuss.elastic.co/t/one-line-json-parsing-into-separate-events-logs/191074 "2019-07-17T18:56:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\
**Post date:** [July 17, 2019, 6:56pm UTC](https://discuss.elastic.co/t/one-line-json-parsing-into-separate-events-logs/191074/1 "2019-07-17T18:56:54Z")

</div>

Hi,

I am trying to ingest some logs via filebeats, the logs get to logstash but only one event is created, the logs are all on one line as per the example below, I have trimmed it down.

{"requests": [{"originId": 283019416, "originType": "Networks", "internalIp": "196.111.111.111", "externalIp": "196.111.111.111", "categories": ["Malware"], "tags": , "destination": "[somedomain.com](http://somedomain.com)", "originLabel": "primary int", "actionTaken": "BLOCKED", "datetime": "2019-07-16T15:21:49.000Z"}, {"originId": 283019416, "originType": "Networks", "internalIp": "196.111.111.111", "externalIp": "196.111.111.111", "categories": ["Malware"], "tags": , "destination": "[somedomain.com](http://somedomain.com)", "originLabel": "primary in", "actionTaken": "BLOCKED", "datetime": "2019-07-16T14:18:14.000Z"}]}

An example of my filebeat config is as below

- type: log  
paths:
  - /opt/logcollection/\*.json  
json.keys\_under\_root: false  
json.add\_error\_key: true  
tags: ["dns"]

my logstash conf is:  
input {  
beats {  
port =\> "5044"  
tags =\> ["beat"]  
codec =\> "json"  
}  
}  
I have also tried json\_lines and the json filter. I have validated the JSON i just cannot seem to get filebeats or logstash to separate the events. Are filebeats/logstash the right place to do this or should I be using the python request to parse the data and create the events on separate lines?

I have gone through a number of threads and the elastic guides, tried a lot of permutations of the settings and I do not seem to be getting anyway and hoping if someone can point me in the right direction.

Thanks  
Phil

---

<div class="post-metadata">

**Author:** ![Michal\_Pristas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michal_pristas/32/46639_2.png) [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)\
**Post date:** [July 18, 2019, 3:14pm UTC](https://discuss.elastic.co/t/one-line-json-parsing-into-separate-events-logs/191074/2 "2019-07-18T15:14:46Z")

</div>

can you please format config and sample events using `</>`

just to be on the same page. you expect event to be created for each request out of set of requests, right?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2019, 3:14pm UTC](https://discuss.elastic.co/t/one-line-json-parsing-into-separate-events-logs/191074/3 "2019-08-15T15:14:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.