title: ELK stack + Filebeat for collecting Rails logs
body: <p>I have installed an ELK stack on a Virtual Machine and I want to collect logs from some Ruby on Rails applications.</p>
  
  <p>On each vm where I have a Rails Application I have installed Filebeat with this config:</p>
  
  <pre><code>filebeat:
    prospectors:
      -
        paths:
          - path_to_rails_log_file.log
        input_type: log
        fields_under_root: true
        fields:
          tags: ['json']
  
  output:
    logstash:
      hosts: ["192.168.1.232:5044"]
      bulk_max_size: 1024
      tls:
        certificate_authorities: ["path_to_certificate.crt"]
  
  shipper:
  logging:
    files:
      rotateeverybytes: 10485760 # = 10MB
  </code></pre>
  
  <p>On VM with ELK stack I have this <code>02-beats-input.conf</code>:</p>
  
  <pre><code>input {
    beats {
      port =&gt; 5044
      ssl =&gt; true
      ssl_certificate =&gt; "/etc/pki/tls/certs/filebeat-forwarder.crt"
      ssl_key =&gt; "/etc/pki/tls/private/filebeat-forwarder.key"
    }
  }
  
  filter {
   if [tag][json] { 
     json {
       source =&gt; "message"
     }
   }
  }
  output {
   elasticsearch {
      hosts =&gt; "localhost:9200"
      manage_template =&gt; false
      index =&gt; "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
      document_type =&gt; "%{[@metadata][type]}"
   }
  }
  </code></pre>
  
  <p>I don't understand why in Kibana web interface my logs look like:</p>
  
  <pre><code>message: {"method":"GET","path":"/","format":"html","controller":"application","action":"index","status":200, "duration":7.91,"view":0.31,"db":0.0,"ip":"req_ip","route":"application#index","request_id":"some_id","source":"127.0.1.1","tags":["request"],"@timestamp":"2017-02-10T06:52:01.984Z","@version":"1"} @version:1 @timestamp:February 10th 2017, 08:52:10.451 offset:25,747 type:log tags:json, beats_input_codec_plain_applied beat.hostname:deployer-VirtualBox
  </code></pre>
  
  <p>I would like, if is possible, each entry to be the content under the key "message" without this key. </p>
  
  <p>What am I doing wrong? :(</p>
  
  <p>P.S. My Rails logs are in JSON format and I am reading that file from Filebeat.</p>