{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/filebeat/issues/311","labels_url":"https://api.github.com/repos/elastic/filebeat/issues/311/labels{/name}","comments_url":"https://api.github.com/repos/elastic/filebeat/issues/311/comments","events_url":"https://api.github.com/repos/elastic/filebeat/issues/311/events","html_url":"https://github.com/elastic/filebeat/issues/311","id":121290050,"number":311,"title":"Sending JSON directly to ES with Filebeat","user":{"login":"Sergej-Popov","id":1652990,"avatar_url":"https://avatars.githubusercontent.com/u/1652990?v=3","gravatar_id":"","url":"https://api.github.com/users/Sergej-Popov","html_url":"https://github.com/Sergej-Popov","followers_url":"https://api.github.com/users/Sergej-Popov/followers","following_url":"https://api.github.com/users/Sergej-Popov/following{/other_user}","gists_url":"https://api.github.com/users/Sergej-Popov/gists{/gist_id}","starred_url":"https://api.github.com/users/Sergej-Popov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sergej-Popov/subscriptions","organizations_url":"https://api.github.com/users/Sergej-Popov/orgs","repos_url":"https://api.github.com/users/Sergej-Popov/repos","events_url":"https://api.github.com/users/Sergej-Popov/events{/privacy}","received_events_url":"https://api.github.com/users/Sergej-Popov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-12-09T16:50:53Z","updated_at":"2015-12-10T10:37:57Z","closed_at":null,"body":"It would be nice if I could have my message written as object instead of string. I though I might be able to do it with mapping, but couldn't find the way.\r\n\r\nIs this currently possible or I have to go via Logstash?\r\n\r\nMy log files always have correctly formatted JSON objects per line, so I want to bypass Logstash and write directly to ES since there is no enhancement required other then parsing string to JSON.\r\nBut whatever I do I always end up with message as string instead of object.\r\n\r\nI have filebeat configured to read logs:\r\n```\r\nfilebeat:\r\n  prospectors:\r\n      paths:\r\n        - C:\\logs\\*\\*.log\r\n      input_type: log\r\n     document_type: object\r\n```\r\n\r\nresulting event\r\n\r\n```\r\n{\r\n      \"_index\" : \"filebeat-2015.12.09\",\r\n      \"_type\" : \"object\",\r\n      \"_id\" : \"AVGHlgXkvPp1bej3HrM4\",\r\n      \"_score\" : 1.0,\r\n      \"_source\":{\"@timestamp\":\"2015-12-09T16:32:09.822Z\",\"beat\":{\"hostname\":\"MACHINE-A\",\"name\":\"MACHINE-A\"},\"count\":1,\"fields\":null,\"input_type\":\"log\",\"message\":\"{ \\\"date\\\": \\\"2015-12-09 16:32:05,000 UTC\\\", \\\"message\\\": \\\"msg1\\\", \\\"level\\\": \\\"Info\\\"}\",\"offset\":933,\"source\":\"C:\\\\logs\\\\test\\\\test.log\",\"type\":\"object\"}\r\n    }\r\n```\r\n\r\n\r\n\r\nfilebeat mapping:\r\n\r\n```\r\n{\r\n  \"filebeat\" : {\r\n    \"order\" : 0,\r\n    \"template\" : \"filebeat-*\",\r\n    \"settings\" : {\r\n      \"index\" : {\r\n        \"refresh_interval\" : \"5s\"\r\n      }\r\n    },\r\n    \"mappings\" : {\r\n      \"_default_\" : {\r\n        \"dynamic_templates\" : [ {\r\n          \"template1\" : {\r\n            \"mapping\" : {\r\n              \"ignore_above\" : 1024,\r\n              \"index\" : \"not_analyzed\",\r\n              \"type\" : \"{dynamic_type}\",\r\n              \"doc_values\" : true\r\n            },\r\n            \"match\" : \"*\"\r\n          }\r\n        } ],\r\n        \"_all\" : {\r\n          \"norms\" : {\r\n            \"enabled\" : false\r\n          },\r\n          \"enabled\" : true\r\n        },\r\n        \"properties\" : {\r\n          \"@timestamp\" : {\r\n            \"type\" : \"date\"\r\n          },\r\n          \"offset\" : {\r\n            \"type\" : \"long\",\r\n            \"doc_values\" : \"true\"\r\n          },\r\n          \"message\" : {\r\n            \"index\" : \"analyzed\",\r\n            \"type\" : \"object\"\r\n          }\r\n        }\r\n      }\r\n    },\r\n    \"aliases\" : { }\r\n  }\r\n}\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/filebeat/issues/comments/163573235","html_url":"https://github.com/elastic/filebeat/issues/311#issuecomment-163573235","issue_url":"https://api.github.com/repos/elastic/filebeat/issues/311","id":163573235,"user":{"login":"ruflin","id":244900,"avatar_url":"https://avatars.githubusercontent.com/u/244900?v=3","gravatar_id":"","url":"https://api.github.com/users/ruflin","html_url":"https://github.com/ruflin","followers_url":"https://api.github.com/users/ruflin/followers","following_url":"https://api.github.com/users/ruflin/following{/other_user}","gists_url":"https://api.github.com/users/ruflin/gists{/gist_id}","starred_url":"https://api.github.com/users/ruflin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ruflin/subscriptions","organizations_url":"https://api.github.com/users/ruflin/orgs","repos_url":"https://api.github.com/users/ruflin/repos","events_url":"https://api.github.com/users/ruflin/events{/privacy}","received_events_url":"https://api.github.com/users/ruflin/received_events","type":"User","site_admin":false},"created_at":"2015-12-10T10:37:57Z","updated_at":"2015-12-10T10:37:57Z","body":"@kimchy :+1: We should definitively further discuss the schema based on what is produced by others, especially which fields should be overwritten.\r\n@urso Good to know."}}