# Use logstash or filebeat for sending azure JSON logs?

**URL:** <https://discuss.elastic.co/t/use-logstash-or-filebeat-for-sending-azure-json-logs/74456>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 9, 2017, 2:09am UTC](https://discuss.elastic.co/t/use-logstash-or-filebeat-for-sending-azure-json-logs/74456 "2017-02-09T02:09:16Z")\
**Posts on this page:** 1\
**Showing post:** 17

<div class="post-metadata">

**Author:** ![111148](https://avatars.discourse-cdn.com/v4/letter/1/eb8c5e/32.png) [@111148](https://discuss.elastic.co/u/111148)\
**Post date:** [March 1, 2017, 8:29pm UTC](https://discuss.elastic.co/t/use-logstash-or-filebeat-for-sending-azure-json-logs/74456/17 "2017-03-01T20:29:27Z")

</div>

Looks like logstash forum has no answer as well on this question. what a shame.

> [@Logstash can not parse azure activity logs](https://discuss.elastic.co/t/logstash-can-not-parse-azure-activity-logs/76801):
>
> Hello, I have faced with issue during parsing Azure activity logs (multiline json) by Logstash. Tried several codecs but all of them are useless. They can not parse multiline logs with coma delimiters. Please advise how to fix it and add custom fields from Json file to the logstash index (logstash-\*). Thanks. Json files sctucture is next: { "time": "2017-02-28T12:04:25.7263914Z", "resourceId": "/SUBSCRIPTIONS/...../RESOURCEGROUPS/....", "operationName": "MICROSOFT.RESOURCES/SUBSC…

---

_[View the full topic](https://discuss.elastic.co/t/use-logstash-or-filebeat-for-sending-azure-json-logs/74456)._