Parse JSON data with filebeat

Elastic Stack Beats
2

Are the JSON objects written as one per line? The multiline configuration seems to indicate that are not. In general, I'd recommend:

  • configuring logrus to output one object per line
  • remove the multiline configuration
  • Use the json decoding at the prospector level, instead of the processor

See, for example, this blog post on the topic.