# Parsing JSON objects

**URL:** <https://discuss.elastic.co/t/parsing-json-objects/126906>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 5, 2018, 11:24am UTC](https://discuss.elastic.co/t/parsing-json-objects/126906 "2018-04-05T11:24:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maek\_Twain](https://avatars.discourse-cdn.com/v4/letter/m/bc79bd/32.png) [@Maek\_Twain](https://discuss.elastic.co/u/Maek_Twain)\
**Post date:** [April 5, 2018, 11:24am UTC](https://discuss.elastic.co/t/parsing-json-objects/126906/1 "2018-04-05T11:24:59Z")

</div>

I have a json logs coming from websites like this

```auto
"{\"path\":\"/visitors/events/\",\"value\":{\"fingerprint\":\"b9fcd389db7f5ca5fad9c767909c481a\",\"sessionId\":\"d7c41580-6155-1b2c-27f5-65c7e19a7174\",\"visitorId\":\"82a9178c-09f8-b021-1815-b558ce48778f\",\"trackingId\":\"INF-XXXXXXX\",\"userId\":null,\"userProfile\":null,\"target\":{\"selector\":\"p:nth-child(3)\"},\"duration\":2587.200000009034,\"timestamp\":\"2018-04-05T11:12:22.045Z\",\"event\":\"engage\",\"source\":{\"url\":{\"hash\":\"#nodeunit-header\",\"host\":\"localhost:8000\",\"hostname\":\"localhost\",\"pathname\":\"/test-api.html\",\"protocol\":\"http:\",\"query\":{\"q\":\"super duper query\"}}}}}

```

or like this -

```auto
"{\"path\":\"/visitors/events/\",\"value\":{\"fingerprint\":\"b9fcd389db7f5ca5fad9c767909c481a\",\"sessionId\":\"d7c41580-6155-1b2c-27f5-65c7e19a7174\",\"visitorId\":\"82a9178c-09f8-b021-1815-b558ce48778f\",\"trackingId\":\"INF-XXXXXXX\",\"userId\":null,\"userProfile\":null,\"timestamp\":\"2018-04-05T11:12:18.786Z\",\"event\":\"click\",\"source\":{\"url\":{\"hash\":\"#nodeunit-header\",\"host\":\"localhost:8000\",\"hostname\":\"localhost\",\"pathname\":\"/test-api.html\",\"protocol\":\"http:\",\"query\":{\"q\":\"super duper query\"}}}}}",

```

I am using Elastic stack using docker where I am sending above via filebeats --\> Logstash --\> ES.

Using kibana for visualisation what I need is to filter on the above key inside the json,i have gone through various post related to Logging using json\_decoding and other methods like splitting.

None of them working my configuration is ass below.

```auto
filebeat.prospectors:
  paths:
    - /var/logs/websocket.log
  multiline.pattern: '^{'
  multiline.negate: true
  multiline.match: after
  processors:
  - decode_json_fields:
      fields: ['message']
      target: json

#output.elasticsearch:
# hosts: ['elasticsearch:9200']
# username: elastic
# password: changeme
output.logstash:
  hosts: ["logstash:5044"]

```

And my Logstash conf

```auto
input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ['elasticsearch']
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
    user => 'elastic'
    password => 'changeme'
  }
}

```

Point me to a direction.

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [April 5, 2018, 2:06pm UTC](https://discuss.elastic.co/t/parsing-json-objects/126906/2 "2018-04-05T14:06:58Z")

</div>

The logs have to contain a json object on each line. Are the lines in the logs exactly as you pasted them? If they are they contain escape characters that cannot be parsed as JSON.

Regarding configuration, you should use [`json` options](https://www.elastic.co/guide/en/beats/filebeat/6.2/configuration-filebeat-options.html#config-json) of the filebeat prospector.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2018, 2:07pm UTC](https://discuss.elastic.co/t/parsing-json-objects/126906/3 "2018-05-03T14:07:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.