# Parse json in "logstash or filebeat from a text file line?

**URL:** <https://discuss.elastic.co/t/parse-json-in-logstash-or-filebeat-from-a-text-file-line/154956>\
**Category:** Logstash\
**Created:** [November 1, 2018, 4:40am UTC](https://discuss.elastic.co/t/parse-json-in-logstash-or-filebeat-from-a-text-file-line/154956 "2018-11-01T04:40:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hgaxifodu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hgaxifodu/32/37194_2.png) [@hgaxifodu](https://discuss.elastic.co/u/hgaxifodu)\
**Post date:** [November 1, 2018, 4:40am UTC](https://discuss.elastic.co/t/parse-json-in-logstash-or-filebeat-from-a-text-file-line/154956/1 "2018-11-01T04:40:57Z")

</div>

`"message": "update请求[{"UserName":"fullwang","CardType":"1","IdNum":"1000001","AccountId":"10000128","PassengerState":1,"FailMsg":"over"}]net/http: request canceled (Client.Timeout exceeded while awaiting headers)",`

`"message": "已完成：{"error_msg":"","orderList":[{"cancel_flag":"N","confirm_flag":"N","if_deliver":"N","insure_query_no":"","integral_pay_flag":"N","myTicketList":[{"arrive_date":"20181022","arrive_time":"1709","batch_no":"1","cancel_flag":"N","coach_name":"13","coach_no":"13","confirm_flag":"N","queue_message":null}],"succ_flag":"1"}",`

`"message": "123：{"Id":"","Session":{"CdnIpAddress":"2229","BoxClient":{"Url":"111","Key":"224b2913","AppId":"base"}"Data":"{\"_requestBody\":{\"baseDTO\":{\"check_code\":\"\",\"device_no\":\"\",\"mobile_no\":\"\",\"os_type\":\"\",\"time_str\":\"\",\"user_name\":\"\",\"version_no\":\"\"}}}"}",`

I want to parse the JSON data ，  
There may be other fields in the data header and tail, I don't need it.

Is there any way to quickly match the json part of the data?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 29, 2018, 4:41am UTC](https://discuss.elastic.co/t/parse-json-in-logstash-or-filebeat-from-a-text-file-line/154956/2 "2018-11-29T04:41:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.