# Unknown field - Filebeat json parsing

**URL:** <https://discuss.elastic.co/t/unknown-field-filebeat-json-parsing/359162>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 9, 2024, 10:06am UTC](https://discuss.elastic.co/t/unknown-field-filebeat-json-parsing/359162 "2024-05-09T10:06:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nguyen\_Nam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nguyen_nam/32/125404_2.png) [@Nguyen\_Nam](https://discuss.elastic.co/u/Nguyen_Nam)\
**Post date:** [May 9, 2024, 10:06am UTC](https://discuss.elastic.co/t/unknown-field-filebeat-json-parsing/359162/1 "2024-05-09T10:06:09Z")

</div>

Hi.  
Im using filebeat to send to Opensearch a preformatted json logfile. The files are parsing fine, but i have an unknown field and i don´t know why:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6ccb459ad10307895470f1fea415b5abe019cf7d.png)

My log file :

```auto
{"data": {"affected_items": [{"cpu": {"cores": 8, "mhz": 2594, "name": "Intel Core Processor (Broadwell, no TSX, IBRS)"}, "ram": {"free": 14336760, "total": 16372160, "usage": 13}, "scan": {"id": 0, "time": "2024-05-09T08:47:30+00:00"}, "board_serial": " ", "agent_id": "058"}], "total_affected_items": 1, "total_failed_items": 0, "failed_items": []}, "message": "All specified syscollector information was returned", "error": 0}
{"data": {"affected_items": [{"cpu": {"cores": 8, "mhz": 2694, "name": "Intel(R) Xeon(R) Gold 6258R CPU @ 2.70GHz"}, "ram": {"free": 8709676, "total": 16362568, "usage": 47}, "scan": {"id": 0, "time": "2024-05-09T09:06:25+00:00"}, "board_serial": "None", "agent_id": "082"}], "total_affected_items": 1, "total_failed_items": 0, "failed_items": []}, "message": "All specified syscollector information was returned", "error": 0}

```

Filebeat config

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - syscollector.log
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: log
processors:
- drop_fields:
    fields: ["message" , "error"]
- add_tags:
    tags: ["wazuh", "sys-wazuh"]
output.logstash:
  hosts: ["x.y.x.v:port"]

```

Any ideas?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 9, 2024, 10:06am UTC](https://discuss.elastic.co/t/unknown-field-filebeat-json-parsing/359162/2 "2024-05-09T10:06:09Z")

</div>

OpenSearch/OpenDistro are AWS run products and differ from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance. See [What is OpenSearch and the OpenSearch Dashboard? | Elastic](https://www.elastic.co/elasticsearch/opensearch) for more details.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )