Hi all, I'm trying to read the data fields of a JSON message from my anti virus with filebeat, but somehow it keeps showing up as a full message. It doesn't filter/detect the process.name and hostname and PID either. Here's a example message I get: May 5 10:58:36 app ERAServer[880] {"event_type…

Never mind, fixed it using logstash instead.

Read JSON fields with filebeat

warkolm (Mark Walkom) May 5, 2019, 11:07pm 3

I was gunna say that or use the Ingest API in Elasticsearch.

Topic		Replies	Views
Filebeat JSON message Beats	3	5185	November 24, 2017
Parse JSON data with filebeat Beats filebeat	8	60924	April 24, 2017
Filebeat parse json Beats filebeat	8	7516	June 7, 2018
Parse json with filebeat Beats filebeat	8	2723	November 24, 2017
Drop beginning of JSON log Beats filebeat	4	768	July 4, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Read JSON fields with filebeat

Related topics