# Parse JSON data with filebeat

**URL:** https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008
**Category:** Beats
**Tags:** filebeat
**Created:** [March 25, 2017, 8:08pm UTC](https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008 "2017-03-25T20:08:24Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [March 27, 2017, 5:14pm UTC](https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008/4 "2017-03-27T17:14:43Z")

</div>

For those logs I would use `message_key: msg`. But you can also omit that config option because it's optional and you are not doing anything that would required it.

I ran a quick test with your logs and this config and it worked as expected.

```auto
filebeat.prospectors:
- paths:
   - test.json
  input_type: log
  json.keys_under_root: true
  json.add_error_key: true

output.elasticsearch:
  hosts: ["http://localhost:9200"]

```

I was getting data like:

```auto
{
  "@timestamp": "2017-03-27T17:11:31.359Z",
  "beat": {
    "hostname": "x",
    "name": "x",
  },
  "error": "dial tcp 172.21.0.2:5432: getsockopt: connection refused",
  "input_type": "log",
  "level": "error",
  "msg": "Could not open database connection",
  "offset": 790,
  "source": "/Users/akroh/go/src/github.com/elastic/beats/filebeat/.test/logrus/test.json",
  "time": "2017-03-27T16:36:55Z",
  "type": "log"
}

```

---

_[View the full topic](https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008)._