CODEWITHSUNDEEP
logstashkibanaelastic-stack
vidola
vidola

Reputation: 334

How to parse a json from log

I'm newbie at Logstash/Kibana (ELK stack) and I dont know how to parse the given json from my log and add "message" and "application" attributes as a field at Kibana.

<30>Jan 30 17:52:43 bts/cit-bts-pms-middleware-dev:sprint-01/cit-bts-pms-middleware-dev[862]: {"timestamp":"2017-01-30T17:52:43.713+00:00","message":"Error processing.", "application": "fooApp"}

Tks all

Upvotes: 0

Views: 114

Answers (1)

Kulasangar
Kulasangar

Reputation: 9454

You might have to use the codec plugin in order to read JSON formatted content. The input could look something like this:

input {
    file {
       type => "json"
       path => "/pathto/your.log"
       codec => json
    }
}

This should actually do the trick.

OR you could still use the json filter which could look something like this. But make sure to remove the codec if you're using the below:

filter {
  json {
    source => "message"
  }
}

Once the fields are added to every ES record using logstash, you should be able to access them in Kibana.

Upvotes: 0

Related Questions