# Send json message from filebeat to logstash (multi-line)

**URL:** <https://discuss.elastic.co/t/send-json-message-from-filebeat-to-logstash-multi-line/178042>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 23, 2019, 12:15pm UTC](https://discuss.elastic.co/t/send-json-message-from-filebeat-to-logstash-multi-line/178042 "2019-04-23T12:15:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![xodn0812](https://avatars.discourse-cdn.com/v4/letter/x/c5a1d2/32.png) [@xodn0812](https://discuss.elastic.co/u/xodn0812)\
**Post date:** [April 23, 2019, 12:15pm UTC](https://discuss.elastic.co/t/send-json-message-from-filebeat-to-logstash-multi-line/178042/1 "2019-04-23T12:15:58Z")

</div>

I would like to send json-formatted messages to logstash via filebeat.

i can filter each key value in json by writing the following in filebeat:

```
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: message

```

However, multi-line could not be processed. How can I get a multi-line?

And, Can I get rid of the fields that are added to filebeat by default? I want to remove metadata from filebeat. I want to receive only the information I send from logstash. Just like in a file. Is there no way??

`{"1": "val1" ,"2": "val2" ,"3": "val3\nval3\nval3" }`

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 23, 2019, 9:45pm UTC](https://discuss.elastic.co/t/send-json-message-from-filebeat-to-logstash-multi-line/178042/2 "2019-04-23T21:45:03Z")

</div>

Filebeat json on the input expects you to have one json document per line.

How exactly is your json encoded? Is it pretty printed with intendation? In simple cases one can configure multiline by matching on the pattern `^}$`. In this case do not use the `json` settings, but the [decode\_json\_fields](https://www.elastic.co/guide/en/beats/filebeat/current/decode-json-fields.html) processor.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2019, 9:45pm UTC](https://discuss.elastic.co/t/send-json-message-from-filebeat-to-logstash-multi-line/178042/3 "2019-05-21T21:45:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.