# Parsing message with filebeat

**URL:** <https://discuss.elastic.co/t/parsing-message-with-filebeat/175367>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 4, 2019, 9:36am UTC](https://discuss.elastic.co/t/parsing-message-with-filebeat/175367 "2019-04-04T09:36:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Christophe](https://avatars.discourse-cdn.com/v4/letter/c/848f3c/32.png) [@Christophe](https://discuss.elastic.co/u/Christophe)\
**Post date:** [April 4, 2019, 9:36am UTC](https://discuss.elastic.co/t/parsing-message-with-filebeat/175367/1 "2019-04-04T09:36:21Z")

</div>

Dear all,

I installed filebeat on my server, and it's configured to read the auth.log file.  
The information in the auth.log file is sending to ELK.

In Kibana I have a JSON message with a label message. This label is a string like this : "app sshd[27546]: Failed password for root from XXX.XXX.XXX.XXX port 47307 ssh2"

I search on internet and I found this to match the line : %{SYSLOGTIMESTAMP:system.auth.timestamp} %{SYSLOGHOST:system.auth.hostname} sshd(?:\[%{POSINT:system.auth.pid}\])?: %{DATA:system.auth.ssh.event} %{DATA:system.auth.ssh.method} for (invalid user )?%{DATA:system.auth.user} from %{IPORHOST:system.auth.ip} port %{NUMBER:system.auth.port} ssh2(: %{GREEDYDATA:system.auth.ssh.signature})?

Can you tell me how I can "filter" the message section in my JSON to to have new fields in Kibana and make some Dashboard.

Thanks for your help

Best regards

---

<div class="post-metadata">

**Author:** ![Michal\_Pristas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michal_pristas/32/46639_2.png) [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)\
**Post date:** [April 5, 2019, 7:10am UTC](https://discuss.elastic.co/t/parsing-message-with-filebeat/175367/2 "2019-04-05T07:10:37Z")

</div>

Hey @Christophe welcome to Elastic Discuss.

Maybe you can consider using [ingest node](https://www.elastic.co/guide/en/beats/filebeat/6.7/configuring-ingest-node.html) or using [logstash](https://www.elastic.co/guide/en/logstash/6.7/config-examples.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2019, 7:10am UTC](https://discuss.elastic.co/t/parsing-message-with-filebeat/175367/3 "2019-05-03T07:10:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.