# Wrap Json message in filter

**URL:** <https://discuss.elastic.co/t/wrap-json-message-in-filter/161549>\
**Category:** Logstash\
**Created:** [December 19, 2018, 4:13pm UTC](https://discuss.elastic.co/t/wrap-json-message-in-filter/161549 "2018-12-19T16:13:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mickt](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@mickt](https://discuss.elastic.co/u/mickt)\
**Post date:** [December 19, 2018, 4:13pm UTC](https://discuss.elastic.co/t/wrap-json-message-in-filter/161549/1 "2018-12-19T16:13:45Z")

</div>

I have log entries like

`{"timeMillis":1545209409013,"thread":"ajp-bio-9003-exec-10","level":"INFO","loggerName":"com.company.Class","message":"Timeslot ID: null","endOfBatch":false,"loggerFqcn":"com.company.MyLogger","threadId":165,"threadPriority":5}`

Filebeat is configured with `fields_under_root: true` and it is shipping the json logs to LS

LS is filtering the log message and passing it to ES via

```
filter {
  json {
    source => message
  }
}

```

The different fields (timemillis, thread, ..) are being added under root.  
I would like now to prepend them with something like `myApp.` (myApp.timemillis, etc)

How can I achieve this? Should I better do it in LS filters or is it possible to do it at Filebeat level?

---

<div class="post-metadata">

**Author:** ![mickt](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@mickt](https://discuss.elastic.co/u/mickt)\
**Post date:** [December 21, 2018, 11:02am UTC](https://discuss.elastic.co/t/wrap-json-message-in-filter/161549/2 "2018-12-21T11:02:15Z")

</div>

I have solved with this

```
  json {
    id => "log"
    source => message
    target => log
    remove_field => ["message"]
  }
  mutate {
    rename => { "log" => "[app][log]" }
  }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 18, 2019, 11:02am UTC](https://discuss.elastic.co/t/wrap-json-message-in-filter/161549/3 "2019-01-18T11:02:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.