# \_jsonparsefailure - What is the problem?

**URL:** <https://discuss.elastic.co/t/-jsonparsefailure-what-is-the-problem/96110>\
**Category:** Logstash\
**Created:** [August 7, 2017, 1:22pm UTC](https://discuss.elastic.co/t/-jsonparsefailure-what-is-the-problem/96110 "2017-08-07T13:22:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssasporta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ssasporta/32/13695_2.png) [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Post date:** [August 7, 2017, 1:22pm UTC](https://discuss.elastic.co/t/-jsonparsefailure-what-is-the-problem/96110/1 "2017-08-07T13:22:29Z")

</div>

My input looks like that:

`10.108.2.44 "73.91.231.150, 10.10.10.165" - - [26/Jul/2017:00:00:00 -0500] "GET /wod/landing?c=e&macId=90%3Ac7%3Ad8%3Afa%3A78%3Ae9&location=WODTrial&apMacId=10%3A56%3A11%3A15%3Ad3%3A8d&a=as&bn=st22&wod=1&issuer=r&deviceModel=ZTE+Jasper+LTE HTTP/1.1" 303 -`

In my grok I defined the part of:

`macId=90%3Ac7%3Ad8%3Afa%3A78%3Ae9&location=WODTrial&apMacId=10%3A56%3A11%3A15%3Ad3%3A8d&a=as&bn=st22&wod=1&issuer=r&deviceModel=ZTE+Jasper+LTE`

as a json, and named it : **jsonstring**.

My filter also contains:

```
if [jsonstring] =~ /.+/ {
                   split {
                           field => "jsonstring"
                           terminator => "&"
                           add_tag => ["splittedjson"]
                   }
                   json {
                           source => "jsonstring"
                           target => "parsedJson"
                           remove_field=>["jsonstring"]
                           add_field => ["macid", "%{[parsedJson][macid]}" ]
                           add_field => ["apmacid", "%{[parsedJson][apmacid]}" ]
                           add_field => ["bn", "%{[parsedJson][bn]}" ]
                           add_field => ["a", "%{[parsedJson][a]}" ]
                           add_field => ["issuer", "%{[parsedJson][issuer]}" ]
                           add_field => ["deviceModel", "%{[parsedJson][deviceModel]}" ]
                   }
                   urldecode {
                      field => "macid"
                   }
                   urldecode {
                      field => "apmacid"
                   }
                }

```

The event is split !  
The add\_field isn't working and I am getting \_jsonparsefailure all time.

Thanks  
Sharon.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 8, 2017, 5:16am UTC](https://discuss.elastic.co/t/-jsonparsefailure-what-is-the-problem/96110/2 "2017-08-08T05:16:01Z")

</div>

The string you want to parse as JSON isn't JSON so a json filter will never work. Use a kv filter instead of your current split+json combo. Also, the split filter doesn't do what you think it does.

---

<div class="post-metadata">

**Author:** ![ssasporta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ssasporta/32/13695_2.png) [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Post date:** [August 8, 2017, 8:18am UTC](https://discuss.elastic.co/t/-jsonparsefailure-what-is-the-problem/96110/3 "2017-08-08T08:18:13Z")

</div>

You were right.  
I used kv and it worked.

Thanks  
Sharon.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 5, 2017, 8:18am UTC](https://discuss.elastic.co/t/-jsonparsefailure-what-is-the-problem/96110/4 "2017-09-05T08:18:28Z")

</div>

Closed on September 5, 2017, 8:18am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.