When the uniface product creates a log line it looks as follows:

{"application":"space_ship","platform":"MSW","version":"10.4.02.045","user":"pluto","hostname":"sun.universe.com","pid":"9316","timestamp":"2024-05-27T09:32:47.07","level":"info","message":"Hello Moon"}

This shows all possible fields. The fields which are redundant can be removed by changing the settings in uniface. The only field which cannot be filtered out is “message”.

When I use logstash to push the data forward to elastic services the “message” field of the logstash output contains the complete JSON, making it impossible to filter in Kibana on the different fields of the uniface output.
When using FileBeat the same problem can be observed.

I’m looking for a way to pass through the JSON in a way that Kibana shows the fields in the JSON as separate fields to allow filtering.

How can I achieve this?

Thanks for help
Jasper de Keijzer

I used logstash with the plain text output of uniface but was missing the severity level which is available in the JSON logging output of uniface. So the JSON output is needed, however filtering became in Kibana impossible since the complete JSON logline is put into the message field.
FileBeat shows the same issue.