# Where to apply the JSON settings in Filebeat input section

**URL:** https://discuss.elastic.co/t/where-to-apply-the-json-settings-in-filebeat-input-section/318289
**Category:** Beats
**Tags:** filebeat
**Created:** [November 7, 2022, 6:05am UTC](https://discuss.elastic.co/t/where-to-apply-the-json-settings-in-filebeat-input-section/318289 "2022-11-07T06:05:01Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![yasar](https://avatars.discourse-cdn.com/v4/letter/y/dc4da7/32.png) [@yasar](https://discuss.elastic.co/u/yasar)
#### Post date: [November 7, 2022, 6:05am UTC](https://discuss.elastic.co/t/where-to-apply-the-json-settings-in-filebeat-input-section/318289/1 "2022-11-07T06:05:01Z")

</div>

Hi team,

We would like to separate to view the JSON field and message field in kibana logs and that we found out the JSON settings below.

```auto
json.keys_under_root: true
json.add_error_key: true
json.message_key: log

```

Could anyone please guide us, where we need to appy the settings in Filebeat input section.

We applied the JSON part in Filebeat input section.. Please tell us, is that correct or not.

```auto

- type: log
  enabled: true
  paths:
    - /var/log/*
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: log
  fields_under_root: true
  fields:
        topic_name: ----
        logtype: -----

```

Thanks,  
Yasar Arafaath A.

---

<div class="post-metadata">

### Author: ![yasar](https://avatars.discourse-cdn.com/v4/letter/y/dc4da7/32.png) [@yasar](https://discuss.elastic.co/u/yasar)
#### Post date: [November 7, 2022, 10:35am UTC](https://discuss.elastic.co/t/where-to-apply-the-json-settings-in-filebeat-input-section/318289/2 "2022-11-07T10:35:40Z")

</div>

Hello All,

After i applied these conditions, we are unable to receive any logs from kibana end.

I would like to clarify our achievement with you is,

we have a message field in kibana side - Discover page. It looks like it’s dumping all of the log entry json into the ‘message’ field, rather than splitting it up

I’d expect to see these as separate lines in Kibana. Please find the below sample message logs from kibana side.

```auto

![image|690x42](upload://ySdxWRpdx52IjPQ19hkcpUC8Vq9.png)

```

Please guide us, how to view the message fields separately.

Thanks in advance,  
Yasar Arafaath A.

---

<div class="post-metadata">

### Author: ![yasar](https://avatars.discourse-cdn.com/v4/letter/y/dc4da7/32.png) [@yasar](https://discuss.elastic.co/u/yasar)
#### Post date: [November 7, 2022, 10:37am UTC](https://discuss.elastic.co/t/where-to-apply-the-json-settings-in-filebeat-input-section/318289/3 "2022-11-07T10:37:56Z")

</div>

Hello All,

Sorry for the inconvenience.. Please find the below snap for the message field.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f46ae7e76e085dfd81d8281b385249be0b201f99.png)

Thanks,  
Yasar Arafaath A.

---

<div class="post-metadata">

### Author: ![yasar](https://avatars.discourse-cdn.com/v4/letter/y/dc4da7/32.png) [@yasar](https://discuss.elastic.co/u/yasar)
#### Post date: [November 8, 2022, 9:05am UTC](https://discuss.elastic.co/t/where-to-apply-the-json-settings-in-filebeat-input-section/318289/4 "2022-11-08T09:05:34Z")

</div>

Hello team,

Could anyone please guide us to proceed further on this.

Thanks,  
Yasar Arafaath A.

---

<div class="post-metadata">

### Author: ![yasar](https://avatars.discourse-cdn.com/v4/letter/y/dc4da7/32.png) [@yasar](https://discuss.elastic.co/u/yasar)
#### Post date: [November 10, 2022, 10:03am UTC](https://discuss.elastic.co/t/where-to-apply-the-json-settings-in-filebeat-input-section/318289/5 "2022-11-10T10:03:37Z")

</div>

Hello team,

Can I get a reply from this, please !!

Thanks,  
Yasar Arafaath A.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 8, 2022, 10:04am UTC](https://discuss.elastic.co/t/where-to-apply-the-json-settings-in-filebeat-input-section/318289/6 "2022-12-08T10:04:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.