# Parse JSON data with filebeat

**URL:** https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008
**Category:** Beats
**Tags:** filebeat
**Created:** [March 25, 2017, 8:08pm UTC](https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008 "2017-03-25T20:08:24Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![calmandniceperson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/calmandniceperson/32/16722_2.png) [@calmandniceperson](https://discuss.elastic.co/u/calmandniceperson)
#### Post date: [March 27, 2017, 4:47pm UTC](https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008/3 "2017-03-27T16:47:17Z")

</div>

Thank you for taking the time to respond.

I changed the configuration of Beats to this:

```
filebeat.prospectors:
- paths:
   - /mnt/log/*.log
  input_type: log
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: log

output.elasticsearch:
  hosts: ["elasticsearch:9200"]
  template.name: filebeat
  template.path: filebeat.template.json

```

This is what the log files look like. Every log is on its own line:

```
{"error":"dial tcp 172.21.0.2:5432: getsockopt: connection refused","level":"error","msg":"Could not open database connection","time":"2017-03-25T14:57:15Z"}
{"error":"dial tcp 172.21.0.2:5432: getsockopt: connection refused","level":"error","msg":"Could not open database connection","time":"2017-03-25T14:57:18Z"}
{"error":"dial tcp 172.21.0.2:5432: getsockopt: connection refused","level":"error","msg":"Could not open database connection","time":"2017-03-27T16:36:49Z"}
{"error":"dial tcp 172.21.0.2:5432: getsockopt: connection refused","level":"error","msg":"Could not open database connection","time":"2017-03-27T16:36:52Z"}
{"error":"dial tcp 172.21.0.2:5432: getsockopt: connection refused","level":"error","msg":"Could not open database connection","time":"2017-03-27T16:36:55Z"}

```

Yet still, Kibana only shows a "message" field. I have a strange feeling that I'm using the message\_key field in a wrong way. Am I using it right? What do I use as the key?

---

_[View the full topic](https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008)._