Sending json format log to kibana using filebeat, logstash and elasticsearch?

Question

I have logs like this:

{\"logId\":\"57aaf6c8d32fb\",\"clientIp\":\"127.0.0.1\",\"time\":\"03:11:29 pm\",\"uniqueSubId\":\"57aaf6c98963b\",\"channelName\":\"JSPC\         


        

Answer 1

I've scoured internet for the exact same problem you are having and tried various suggestions, including those above. However, none helped so I did it the old fashioned way. I went on elasticsearch documentation on filebeat configuration

and all that was required (no need for filters config in logstash)

Filebeat config:

filebeat.prospectors:
- input_type: log
  document_type: #whatever your type is, this is optional
  json.keys_under_root: true
  paths:
    - #your path goes here

keys_under_root

copies nested json keys to top level in the output document.

My filebeat version is 5.2.2.