# Unable to parse json log to Kibana

**URL:** <https://discuss.elastic.co/t/unable-to-parse-json-log-to-kibana/202620>\
**Category:** Logstash\
**Created:** [October 8, 2019, 6:27am UTC](https://discuss.elastic.co/t/unable-to-parse-json-log-to-kibana/202620 "2019-10-08T06:27:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![marek.vesely](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@marek.vesely](https://discuss.elastic.co/u/marek.vesely)\
**Post date:** [October 8, 2019, 6:27am UTC](https://discuss.elastic.co/t/unable-to-parse-json-log-to-kibana/202620/1 "2019-10-08T06:27:32Z")

</div>

Hello,

I have json log like this:  
`{"thread":"http-nio-8943-exec-9","level":"INFO","loggerName":"cz.direct.common.restapi.interceptor.LoggingFilter","message":{"requestNumber":140,"responseCode":200,"contentType":"application/json;charset=UTF-8","headers":{"X-Fishtag":"tal1d20191008083158852"},"payload":{"version":"1.1.13-SNAPSHOT","buildDateTime":"2019-09-30T10:14","runningTime":685055.0}},"endOfBatch":false,"loggerFqcn":"org.apache.commons.logging.LogAdapter$Log4jLog","instant":{"epochSecond":1570516318,"nanoOfSecond":859087000},"contextMap":{"fishtag":"tal1d20191008083158852"},"threadId":33,"threadPriority":5,"timestamp":"2019.10.08 08:31:58.859"}`

filebeat.yml:  
processors:  
- decode\_json\_fields:  
fields: ["message"]  
filebeat.prospectors:  
- fields:  
env: dev02  
type: restapilog  
fields\_under\_root: true  
paths:  
- /var/log/app/restapi-talend-_/logs/actual/restapi-talend-_.log  
tags:  
- app-dev-02-insurance-restapi-talend  
- java-based  
type: log

logstash filter:  
filter {  
if[type] == "restapilog" {  
date {  
match =\> ["timestamp", "yyyy.MM.dd HH:mm:ss.SSS"]  
timezone =\> "Europe/Prague"  
target =\> "@timestamp"  
}  
}

and kibana output:

 ![1](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c50b18e8f646e50a7e5b6659b7f425860ef311b5.png)

Filebeat version: 6.8.3-1  
ELK: 6.8.2-1

---

<div class="post-metadata">

**Author:** ![marek.vesely](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@marek.vesely](https://discuss.elastic.co/u/marek.vesely)\
**Post date:** [October 17, 2019, 8:43am UTC](https://discuss.elastic.co/t/unable-to-parse-json-log-to-kibana/202620/2 "2019-10-17T08:43:31Z")

</div>

nobody knows?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 17, 2019, 3:22pm UTC](https://discuss.elastic.co/t/unable-to-parse-json-log-to-kibana/202620/3 "2019-10-17T15:22:25Z")

</div>

Nobody knows what? Your post did not contain a question.

---

<div class="post-metadata">

**Author:** ![marek.vesely](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@marek.vesely](https://discuss.elastic.co/u/marek.vesely)\
**Post date:** [October 18, 2019, 4:48am UTC](https://discuss.elastic.co/t/unable-to-parse-json-log-to-kibana/202620/4 "2019-10-18T04:48:36Z")

</div>

How to have parsed output in Kibana into fileds? Fields should be message.responseCode, message.reguestNumber, etc... Now it is only 1 big string.

---

<div class="post-metadata">

**Author:** ![marek.vesely](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@marek.vesely](https://discuss.elastic.co/u/marek.vesely)\
**Post date:** [October 29, 2019, 8:02am UTC](https://discuss.elastic.co/t/unable-to-parse-json-log-to-kibana/202620/5 "2019-10-29T08:02:17Z")

</div>

i solved it on my own...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2019, 8:02am UTC](https://discuss.elastic.co/t/unable-to-parse-json-log-to-kibana/202620/6 "2019-11-26T08:02:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.