# Sending Json Logs from Filebeat 5.0.0\_alpha5-1 to Graylog 2.2.0

**URL:** <https://discuss.elastic.co/t/sending-json-logs-from-filebeat-5-0-0-alpha5-1-to-graylog-2-2-0/64809>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 3, 2016, 7:36am UTC](https://discuss.elastic.co/t/sending-json-logs-from-filebeat-5-0-0-alpha5-1-to-graylog-2-2-0/64809 "2016-11-03T07:36:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![onedaywillcome](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/onedaywillcome/32/12922_2.png) [@onedaywillcome](https://discuss.elastic.co/u/onedaywillcome)\
**Post date:** [November 3, 2016, 7:36am UTC](https://discuss.elastic.co/t/sending-json-logs-from-filebeat-5-0-0-alpha5-1-to-graylog-2-2-0/64809/1 "2016-11-03T07:36:33Z")

</div>

I am trying to send my json logs to Graylog. I've configured my filebeat.yml config file that similar to following [post](https://discuss.elastic.co/t/getting-filebeat-to-process-json-logs-from-osquery/54779). However, I am not able to send my logs to Graylog properly and I get "null" message in Graylog that means that Filebeat does not parse my json formatted log. How can I parse json log properly?

Note: I am sending plain text logs smoothly from Filebeat to Graylog.

My Filebeat.yml config file:

```
filebeat.prospectors:
- input_type: log
  paths:
    - /var/log/testfilebeat.log
  document_type: json
  fields:
    type: testfilebeatjson
    codec: json
  json.message_key: log
  json.keys_under_root: true
  json.overwrite_keys: true
  tags: "request"
  document_type: test_request
  tail_files: true

output.logstash:
  hosts: ["10.0.1.10:12201"]
  tls.insecure: true

logging.to_files: true
logging.files:
  path: /var/log/filebeatlogs
  name: filebeatlog
  rotateeverybytes: 104857600 # = 100MB
  keepfiles: 10

```

My Json formatted Log file; /var/log/testfilebeat.log :

`{"_message":{"took":"0","_httpParams":{},"httpUrl":"/v1/json/ping","httpClientIp":"127.0.0.1","httpCFIp":"","httpMethod":"GET","_httpHeaders":{"Accept":"*/*","X-ELB-IP":"10.0.0.0","Connection":"close","User-Agent":"ELB-HealthChecker/1.0","Host":"localhost:9000"},"logTime":"1478044910569","status":"200 OK"},"timestamp":"1477977078"}`

Log is shown in Graylog output as follow:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/a/aae2628d0f9c3d6e9d91efb1dea908c92f23d2bb.png)

Note: I installed Graylog Filebeat plugin from following [link](https://github.com/Graylog2/graylog-plugin-beats).

Graylog version : 2.2.0  
Filebeat version: 5.0.0\_alpha5-1

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [November 3, 2016, 9:46am UTC](https://discuss.elastic.co/t/sending-json-logs-from-filebeat-5-0-0-alpha5-1-to-graylog-2-2-0/64809/2 "2016-11-03T09:46:21Z")

</div>

You defined `json.message_key: log` but in your example entry there is no entry `log`.

---

<div class="post-metadata">

**Author:** ![onedaywillcome](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/onedaywillcome/32/12922_2.png) [@onedaywillcome](https://discuss.elastic.co/u/onedaywillcome)\
**Post date:** [November 3, 2016, 10:19am UTC](https://discuss.elastic.co/t/sending-json-logs-from-filebeat-5-0-0-alpha5-1-to-graylog-2-2-0/64809/3 "2016-11-03T10:19:54Z")

</div>

I tried json.message\_key entry as below, but unfortunately still getting "null" message in Graylog. Is there anyway to parse json?

`json.message_key: _message`

In following config file, messages are shipping in plain text format, and Graylog doesn't understand json formatted entries(especially timestamp is important)

```
filebeat.prospectors:
- input_type: log
  paths:
    - /var/log/testfilebeat.log
  multiline.pattern: ^\{"
  multiline.negate: true
  multiline.match: after
  tags: "request"
  document_type: test_request
  tail_files: false

output.logstash:
  hosts: ["10.0.26.10:12205"]
  tls.insecure: true

logging.to_files: true
logging.files:
  path: /var/log/opsgenieFileBeatLogs
  name: opsgenieFileBeat
  rotateeverybytes: 104857600 # = 100MB
  keepfiles: 10
```

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [November 4, 2016, 7:41am UTC](https://discuss.elastic.co/t/sending-json-logs-from-filebeat-5-0-0-alpha5-1-to-graylog-2-2-0/64809/4 "2016-11-04T07:41:56Z")

</div>

I'm not aware of the inner details of Graylog. Can you try to just use file output and check if you get the expected result?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 24, 2016, 7:36am UTC](https://discuss.elastic.co/t/sending-json-logs-from-filebeat-5-0-0-alpha5-1-to-graylog-2-2-0/64809/5 "2016-11-24T07:36:34Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.