title: JSON escaping in Logstash
body: <p>I am sending some JSON data from Java server via TCP to Logstash (Logstash sends them to Elasticsearch) and these JSON data seems to be escaped in Elastic.</p>
  
  <p>Java serialization:</p>
  
  <pre><code>Map&lt;String, Object&gt; jsonMap = new HashMap&lt;&gt;();
  jsonMap.put("age", event.getAge());
  for (Entry&lt;String, Serializable&gt; attribute : event.getAttributes().entrySet()) {
      jsonMap.put("attribute_" + attribute.getKey(), attribute.getValue());
  }
  jsonMap.put("message", event.getMessage());
  jsonMap.put("cause", event.getCause());
  jsonMap.put("timestamp", event.getTimestamp());
  jsonMap.put("eventid", event.getEventId());
  jsonMap.put("instanceid", event.getInstanceId());
  jsonMap.put("origin", event.getOrigin());
  jsonMap.put("severity", event.getSeverity());
  jsonMap.put("durability", event.getDurability());
  jsonMap.put("detail", event.getDetail());
  int i = 0;
  for (String tag : event.getTags()) {
      jsonMap.put("tag_" + String.valueOf(i), tag);
      i++;
  }
  
  return new JSONObject(jsonMap).toString();
  </code></pre>
  
  <p>Java Socket:</p>
  
  <pre><code>try (Socket clientSocket = new Socket(url, port);
      OutputStreamWriter out = new OutputStreamWriter(
          clientSocket.getOutputStream(), "UTF-8")) {
      out.write(content.toString());
      out.flush();
  }
  </code></pre>
  
  <p>Example data in Elastic:</p>
  
  <pre><code>"message": "{\"detail\":null,\"cause\":null,\"attribute_start\":\"Mon Jan 11 16:15:28 CET 2016\",\"durability\":\"MOMENTARY\",\"attribute_login\":\"\",\"origin\":\"fortuna.ws.navipro\",\"severity\":\"ERROR\",\"attribute_type\":null,\"attribute_methodName\":\"Logout\",\"eventid\":\"ws.navipro.call\",\"attribute_call\":\"[57,7256538816272415441,,OK]{0 connections} CZ() Calling method 'Logout' at 1452525329029(Mon Jan 11 16:15:28 CET 2016-Mon Jan 11 16:15:29 CET 2016; roundtrip=36ms):\\n\\tRequest\\n\\t\\tCLASS com.etnetera.projects.jnp.fortuna.navipro.ws.ClientLogoutRequest\\n\\t\\tkeep: true\\n\\t\\tCLASS com.etnetera.projects.jnp.fortuna.navipro.ws.RequestBody\\n\\t\\tcountry: CZ\\n\\t\\tsessionCC: NULL\\n\\t\\tsessionID:\\n\\t\\tsessionIP:\\n\\t\\tdebug: NULL\\n\\t\\tns: NULL\\n\\t\\tCLASS com.etnetera.projects.jnp.fortuna.navipro.ws.RequestCorpus\\n\\tResponse\\n\\t\\tCLASS com.etnetera.projects.jnp.fortuna.navipro.ws.ClientLogoutResponse\\n\\t\\tCLASS com.etnetera.projects.jnp.fortuna.navipro.ws.ResponseBody\\n\\t\\tCLASS com.etnetera.projects.jnp.fortuna.navipro.ws.ResponseCorpus\\n\\t\\tmessage: \\n\\t\\t[1] \\n\\t\\t\\tCLASS com.etnetera.projects.jnp.fortuna.navipro.ws.Message\\n\\t\\t\\tparam: \\n\\t\\t\\t[1] \\n\\t\\t\\t\\tCLASS com.etnetera.projects.jnp.fortuna.navipro.ws.Message$Param\\n\\t\\t\\t\\tindex: 0\\n\\t\\t\\t\\ttype: NULL\\n\\t\\t\\t\\tvalue: 3\\n\\t\\t\\tid: 104\\n\\t\\t\\tseverity: NOTIFICATION\\n\\t\\t\\tlink: NULL\\n\\t\\tentryLink: NULL\\n\\t\\thint: NULL\\n\\t\\thintType: NULL\\n\\t\\tstatus: OK\\nEND\",\"timestamp\":1452525329030,\"message\":\"NaviPro method Logoutcalled.\",\"tag_1\":\"NaviPro\",\"attribute_end\":\"Mon Jan 11 16:15:29 CET 2016\",\"attribute_sessionId\":\"\",\"age\":0,\"tag_0\":\"Logout\",\"instanceid\":\"Logout\",\"attribute_address\":\""}"
  </code></pre>
  
  <p>Logstash config:</p>
  
  <pre><code>input {
    syslog {
      port =&gt; 1514
    }
    tcp {
      port =&gt; 3333
    }
  }
  
  filter {
    if [type] == "docker" {
      json {
        source =&gt; "message"
      }
      mutate {
        rename =&gt; [ "log", "message" ]
      }
      date {
        match =&gt; [ "time", "ISO8601" ]
      }
    }
  }
  
  output {
    elasticsearch {
      hosts =&gt; "elasticsearch:9200"
    }
  }
  </code></pre>
  
  <p>I want to have data in Elastic as JSON so I can filter fields in Kibana.</p>
  
  <p>EDIT:</p>
  
  <p>If I try to change configuration to this:</p>
  
  <pre><code>input {
    tcp {
      port =&gt; 3333
      codec =&gt; json
    }
  }
  </code></pre>
  
  <p>Logstash refuses to launch with this line in log:</p>
  
  <pre><code>logstash_1 | {:timestamp=&gt;"2016-01-13T10:13:58.583000+0000", :message=&gt;"SIGTERM received. Shutting down the pipeline.", :level=&gt;:warn}
  </code></pre>