# Parsing data from the message field of incoming json
**URL:** https://discuss.elastic.co/t/parsing-data-from-the-message-field-of-incoming-json/97327
**Category:** Logstash
**Created:** [August 17, 2017, 12:07am UTC](https://discuss.elastic.co/t/parsing-data-from-the-message-field-of-incoming-json/97327 "2017-08-17T00:07:45Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@davidmnoriega](https://discuss.elastic.co/u/davidmnoriega)
#### Post date: [August 17, 2017, 12:07am UTC](https://discuss.elastic.co/t/parsing-data-from-the-message-field-of-incoming-json/97327/1 "2017-08-17T00:07:45Z")
I've configured some services to send their logs to rsyslog, which then in turns sends them to logstash as json. The issue is these services have their own format, they include their own timestamp, etc.
```
{
"_index": "syslog-index",
"_type": "syslog",
"_id": "AV3tQLi_sYGi6CaqpdbE",
"_score": 1,
"_source": {
"severity": "info",
"@timestamp": "2017-08-16T22:53:48.088Z",
"host": "packstack",
"@version": "1",
"tag": "gnocchi-metricd:",
"message": "2017-08-16 15:53:48.086 3352 INFO gnocchi.cli [-] 0 measurements bundles across 0 metrics wait to be processed.",
"type": "syslog",
"facility": "local3",
"timestamp": "2017-08-16T15:53:48.087998-07:00"
},
"fields": {
"timestamp": [
1502924028087
],
"@timestamp": [
1502924028088
]
}
}
```
Trouble is I'm not finding examples of taking the message field and breaking that down.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 17, 2017, 3:46am UTC](https://discuss.elastic.co/t/parsing-data-from-the-message-field-of-incoming-json/97327/2 "2017-08-17T03:46:29Z")
Use a grok filter. There are tons of examples of that, e.g. here: [https://www.elastic.co/guide/en/logstash/current/config-examples.html](https://www.elastic.co/guide/en/logstash/current/config-examples.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 14, 2017, 3:46am UTC](https://discuss.elastic.co/t/parsing-data-from-the-message-field-of-incoming-json/97327/3 "2017-09-14T03:46:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.