I'm trying to ingest logs to elasticsearch directly using filebeat 8.17.0 I want to separate the json keys from logs and add it to the root level so I can perform analytics based on the fields. sample log: [23/Jan/2025 11:47:13] INFO [elastic_service:1242] {"sort": [{"newarrivals": "desc"}, {"_sco…

Parsing JSON Log and adding to root level

lester74 February 7, 2025, 7:45am 9

I have modified my logs to complete JSON and removed the dissect processor.

Now decode_json_fields is able to parse my JSON without any issues since it's a complete json.

Topic		Replies	Views
Parse JSON data with filebeat Beats filebeat	8	60994	April 24, 2017
Need help with parsing json fields Logs	4	3742	April 15, 2019
Filebeat send json data to Elastiksearch isuue Logs	6	551	September 18, 2020
Parse json with filebeat Beats filebeat	8	2728	November 24, 2017
Nested JSON parsing issues Beats filebeat	9	1758	February 28, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Parsing JSON Log and adding to root level

Related topics