# Parsing JSON with filebeat

**URL:** https://discuss.elastic.co/t/parsing-json-with-filebeat/165489
**Category:** Beats
**Tags:** filebeat
**Created:** [January 23, 2019, 10:06pm UTC](https://discuss.elastic.co/t/parsing-json-with-filebeat/165489 "2019-01-23T22:06:54Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![bladerunner512](https://avatars.discourse-cdn.com/v4/letter/b/b77776/32.png) [@bladerunner512](https://discuss.elastic.co/u/bladerunner512)
#### Post date: [January 23, 2019, 10:06pm UTC](https://discuss.elastic.co/t/parsing-json-with-filebeat/165489/1 "2019-01-23T22:06:54Z")

</div>

Trying to ship single-line JSON in log file directly to Elasticsearch, but getting entire line with "message" as key:

```auto
January 23rd 2019, 15:51:15.634	
@timestamp:January 23rd 2019, 15:51:15.634 
source:/usr/share/filebeat/logs/gen_log_test.log offset:8,487,442 
message:{"msg":"Hello from thread# 14 for log#176","sub":"GenerateTestLogs","orig":"genlogs-dev-tsvgk","sev":"INFO","line":85,"proj":"Logging","cl":"com.logging.GenerateTestLogs","ts":"2019-01-23T19:34:53:0428Z"} 
prospector.type:log 
beat.version:6.2.1 
beat.name:fb-logs-74895b8df7-mlz2v 
beat.hostname:fb-logs-74895b8df7-mlz2v _id:CfeyfGgB62cDz7C-N4Ra 
_type:doc 
_index:filebeat-6.2.1-2019.01.23 
_score: -

```

```auto
filebeat.prospectors:
- paths:
  - /var/log/mylog.json
  json.keys_under_root: true
  json.add_error_key: true

```

---

<div class="post-metadata">

### Author: ![bladerunner512](https://avatars.discourse-cdn.com/v4/letter/b/b77776/32.png) [@bladerunner512](https://discuss.elastic.co/u/bladerunner512)
#### Post date: [January 25, 2019, 5:34pm UTC](https://discuss.elastic.co/t/parsing-json-with-filebeat/165489/2 "2019-01-25T17:34:11Z")

</div>

ConfigMap error not replacing filebeat.yml with correct values for prospector.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 22, 2019, 5:44pm UTC](https://discuss.elastic.co/t/parsing-json-with-filebeat/165489/3 "2019-02-22T17:44:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
