# Tried to parse field \[log\_json\] as object

**URL:** <https://discuss.elastic.co/t/tried-to-parse-field-log-json-as-object/164710>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 17, 2019, 10:28pm UTC](https://discuss.elastic.co/t/tried-to-parse-field-log-json-as-object/164710 "2019-01-17T22:28:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kody\_Peterson](https://avatars.discourse-cdn.com/v4/letter/k/ee59a6/32.png) [@Kody\_Peterson](https://discuss.elastic.co/u/Kody_Peterson)\
**Post date:** [January 17, 2019, 10:28pm UTC](https://discuss.elastic.co/t/tried-to-parse-field-log-json-as-object/164710/1 "2019-01-17T22:28:56Z")

</div>

Filebeats is throwing this error but it is not configured to do any json processing. Any thoughts?

> {"level":"warn","timestamp":"2019-01-17T21:55:19.132Z","caller":"elasticsearch/client.go:521","message":"Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbf085c22ea8d145c, ext:1783841419872, loc:(\*time.Location)(0x20ee1e0)}, Meta:common.MapStr(nil), Fields:common.MapStr{"offset":1096845, "tags":string{"docker-container"}, "prospector":common.MapStr{"type":"log"}, "host":common.MapStr{"name":"elastic-filebeat-t797m"}, "beat":common.MapStr{"name":"elastic-filebeat-t797m", "hostname":"elastic-filebeat-t797m", "version":"6.5.3"}, "message":"{\"log\":\" \\\"/bin/service-init/index.js\\\"\\n\",\"stream\":\"stdout\",\"time\":\"2019-01-17T20:18:27.924421093Z\"}", "source":"/var/lib/docker/containers/b84b2109973f370c30c3a0f95256c57466e0b9bbfd344569e7e3657aa03b0a23/b84b2109973f370c30c3a0f95256c57466e0b9bbfd344569e7e3657aa03b0a23-json.log", "input":common.MapStr{"type":"log"}, "meta":common.MapStr{"cloud":common.MapStr{"provider":"ec2", "region":"us-east-1", "availability\_zone":"us-east-1a", "instance\_id":" **REDACTED**", "machine\_type":"t2.large"}}}, Private:file.State{Id:"", Finished:false, Fileinfo:(\*os.fileStat)(0xc42024bba0), Source:"/var/lib/docker/containers/b84b2109973f370c30c3a0f95256c57466e0b9bbfd344569e7e3657aa03b0a23/b84b2109973f370c30c3a0f95256c57466e0b9bbfd344569e7e3657aa03b0a23-json.log", Offset:1096960, Timestamp:time.Time{wall:0xbf085a6556afd133, ext:1508152014, loc:(\*time.Location)(0x20ee1e0)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x1f871dc, Device:0xca02}}}, Flags:0x1} (status=400): {"type":"mapper\_parsing\_exception","reason":"object mapping for [log\_json] tried to parse field [log\_json] as object, but found a concrete value"}"}

My configuration for this path:

```auto
- type: log
  paths:- /var/lib/docker/containers/*/*.log
  tags: ["docker-container"]
  processors:
    - add_kubernetes_metadata:
      in_cluster: true

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2019, 10:29pm UTC](https://discuss.elastic.co/t/tried-to-parse-field-log-json-as-object/164710/2 "2019-02-14T22:29:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.