Problem with JSON logs


I'm new to the Elastic Stack and I can't manage to build a pipeline for my Java logs.
I use the Logstack Logstash appender, Filebeat and Elastic Search for now.

Here is my Filebeat configuration.

    - type: log
      enabled: true
        - /var/log/myApp/stash_*
      fields_under_root: true
        app_id: myApp
        env: dev
      hosts: ["http://MyES:9200"]

It does generate entries in ES:

"@timestamp": "2019-02-08T19:52:36.371Z",
"app_id": "myApp",
"message": "{"@timestamp":"2019-02-08T20:52:36.329+01:00","@version":"1","message":"[Application] At path /data/","logger_name":"application","thread_name":"","level":"DEBUG","level_value":10000}",

As you can see, the message is stored as plain text instead of JSON.

What am I missing ?

Thanks in advance

You need to configure log input to decode JSON. See

- type: log
  json.message_key: message

Of course !
Working great, thanks a lot ! :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.