Parsing JSON with filebeat

Elastic Stack Beats
1

Trying to ship single-line JSON in log file directly to Elasticsearch, but getting entire line with "message" as key:

January 23rd 2019, 15:51:15.634	
@timestamp:January 23rd 2019, 15:51:15.634 
source:/usr/share/filebeat/logs/gen_log_test.log offset:8,487,442 
message:{"msg":"Hello from thread# 14 for log#176","sub":"GenerateTestLogs","orig":"genlogs-dev-tsvgk","sev":"INFO","line":85,"proj":"Logging","cl":"com.logging.GenerateTestLogs","ts":"2019-01-23T19:34:53:0428Z"} 
prospector.type:log 
beat.version:6.2.1 
beat.name:fb-logs-74895b8df7-mlz2v 
beat.hostname:fb-logs-74895b8df7-mlz2v _id:CfeyfGgB62cDz7C-N4Ra 
_type:doc 
_index:filebeat-6.2.1-2019.01.23 
_score: -

filebeat.prospectors:
- paths:
  - /var/log/mylog.json
  json.keys_under_root: true
  json.add_error_key: true
1 Like
2

ConfigMap error not replacing filebeat.yml with correct values for prospector.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.