# Parsing mod\_security JSON logs

**URL:** <https://discuss.elastic.co/t/parsing-mod-security-json-logs/95692>\
**Category:** Elasticsearch\
**Created:** [August 3, 2017, 10:23am UTC](https://discuss.elastic.co/t/parsing-mod-security-json-logs/95692 "2017-08-03T10:23:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![cuttlefishjones](https://avatars.discourse-cdn.com/v4/letter/c/e5b9ba/32.png) [@cuttlefishjones](https://discuss.elastic.co/u/cuttlefishjones)\
**Post date:** [August 3, 2017, 10:23am UTC](https://discuss.elastic.co/t/parsing-mod-security-json-logs/95692/1 "2017-08-03T10:23:57Z")

</div>

Hi. I'm hoping someone can provide me with a little guidance and illumination.

I am new to using the ELK stack (as in green as grass) and have been given the task of putting together a system to visualise the output of our mod\_security logs; amongst other things (I'm using Wazuh for the HIDS side).

Our system already produces some nice JSON output, the problem being that it is quite complicated and section of the log 'matched\_rules' comes through as a nested array of objects e.g.:

matched\_rules:{  
chain: boolean,  
rules: [  
{  
actionset:{...},  
operator:{...},  
config:{...},  
unparsed: text,  
is\_matched: boolean  
}  
]}, ... and many more like this.

I'm pushing these through directly as a beat and not through logstash and so far I'm having no luck in being able to properly index this data so it can be searched.

Does anyone have any pointers? (Not the canine variety though)

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2017, 10:24am UTC](https://discuss.elastic.co/t/parsing-mod-security-json-logs/95692/2 "2017-08-31T10:24:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.