title: Kibana. Extract fields from @message containing a JSON
body: <p>I would like to extract in Kiabana fields from @message field which contains a json.
  ex: </p>
  
  <pre><code>Audit{
  uuid='xxx-xx-d3sd-fds3-f43',
  action='/v1.0/execute/super/method', 
  resultCode='SUCCESS', 
  browser='null', 
  ipAddress='192.168.2.44', 
  application='application1', 
  timeTaken='167'
  } 
  </code></pre>
  
  <p>Having "action" and "application" fields I hope to be able to find top 5 requests that hits the application.</p>
  
  <p>I started with something similar to this:</p>
  
  <pre><code>filter {
      if ([message]~ = "Audit") {
          grok {
              match =&gt; {
                  "message" =&gt; "%{WORD:uuid}, %{WORD:action}, %{WORD:resultCode}, %{WORD:browser}, %{WORD:ipAddress}, %{WORD:application}, %{NUMBER:timeTaken}"
              }
              add_field =&gt; ["action", "%{action}"]
              add_field =&gt; ["application", "%{application}"]
          }
      }
  }
  </code></pre>
  
  <p>But it seems to be too far from reality.</p>