Parsing Json within a Json in Filebeat

Elastic Stack Beats
1

Hi Elastic Support,

I'm using Filebeat 6.2.2 and we have a json log that looks like this:

{"Name":"John","Locations":["USA"],"Enabled":true,"Notes":"{"children":2,"details":[{"birthday":"1999-01-01t01:00:00.00000-04:00","childname":"Ringo"},{"birthday":"2001-03-01t01:00:00.00000-04:00","childname":"Michael"}]}"}

image
image.png739×71 2.97 KB

Pretty view:

{
"Name":"John",
"Locations":
[
"USA"
],
"Enabled":true,
"Notes": "{"children":2,"details":[{"birthday":"1999-01-01t01:00:00.00000-04:00","childname":"Ringo"},{"birthday":"2001-03-01t01:00:00.00000-04:00","childname":"Michael"}]}"
}

image
image.png740×194 3.66 KB

When I'm feeding it using Filebeat, it looks like this is Kibana:

Name: John
Locations: USA
Enabled: true
Notes.Children: 2
Notes.details: {
"birthday":"1999-01-01t01:00:00.00000-04:00",
"childname":"Ringo"
},
{ "birthday":"2001-03-01t01:00:00.00000-04:00",
"childname":"Michael"
}

Is there a way for it to be like this is Kibana by just using Filebeat?

Name: John
Locations: USA
Enabled: true
Notes.Children: 2
Notes.details.birthday1: 1999-01-01t01:00:00.00000-04:00
Notes.details.childname1: Ringo
Notes.details.birthday2: 2001-03-01t01:00:00.00000-04:00
Notes.details.childname2: Michael

Filebeat 6.2.2 config:

filebeat.prospectors:

  • type: log
    enabled: true
    paths:

    • d:/Sheen/logs/Person.json
      fields_under_root: true
      json.keys_under_root: true

    processors:

    • decode_json_fields:
      fields: ["Notes"]
      output.console.pretty: true
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.