Where to apply the JSON settings in Filebeat input section

Elastic Stack Beats
1

Hi team,

We would like to separate to view the JSON field and message field in kibana logs and that we found out the JSON settings below.

json.keys_under_root: true
json.add_error_key: true
json.message_key: log

Could anyone please guide us, where we need to appy the settings in Filebeat input section.

We applied the JSON part in Filebeat input section.. Please tell us, is that correct or not.


- type: log
  enabled: true
  paths:
    - /var/log/*
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: log
  fields_under_root: true
  fields:
        topic_name: ----
        logtype: -----

Thanks,
Yasar Arafaath A.

2

Hello All,

After i applied these conditions, we are unable to receive any logs from kibana end.

I would like to clarify our achievement with you is,

we have a message field in kibana side - Discover page. It looks like it’s dumping all of the log entry json into the ‘message’ field, rather than splitting it up

I’d expect to see these as separate lines in Kibana. Please find the below sample message logs from kibana side.


![image|690x42](upload://ySdxWRpdx52IjPQ19hkcpUC8Vq9.png)

Please guide us, how to view the message fields separately.

Thanks in advance,
Yasar Arafaath A.

3

Hello All,

Sorry for the inconvenience.. Please find the below snap for the message field.

image
image1131×69 17.9 KB

Thanks,
Yasar Arafaath A.

4

Hello team,

Could anyone please guide us to proceed further on this.

Thanks,
Yasar Arafaath A.

5

Hello team,

Can I get a reply from this, please !!

Thanks,
Yasar Arafaath A.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.