Send json message from filebeat to logstash (multi-line)

Elastic Stack Beats
1

I would like to send json-formatted messages to logstash via filebeat.

i can filter each key value in json by writing the following in filebeat:

  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: message

However, multi-line could not be processed. How can I get a multi-line?

And, Can I get rid of the fields that are added to filebeat by default? I want to remove metadata from filebeat. I want to receive only the information I send from logstash. Just like in a file. Is there no way??

{"1": "val1" ,"2": "val2" ,"3": "val3\nval3\nval3" }

2

Filebeat json on the input expects you to have one json document per line.

How exactly is your json encoded? Is it pretty printed with intendation? In simple cases one can configure multiline by matching on the pattern ^}$. In this case do not use the json settings, but the decode_json_fields processor.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.