_jsonparsefailure with basic json input

Elastic Stack Logstash
1

Hi,

I have a _jsonparsefailure when receiving json message like this :

{"subscriptionId":"596db6409dd2c052b0ca6e2b",
"data":{"id":"Sensor8",
        "type":"SensingDevice",
        "AZO":{"type":"Number","value":-1.07473e+09,"metadata":{}},
        "DO":{"type":"Number","value":-999,"metadata":{}},
        "HU":{"type":"Number","value":998,"metadata":{}},
        "LU":{"type":"Number","value":3.48,"metadata":{}},
        "RC":{"type":"Number","value":49.17,"metadata":{}},
        "TC":{"type":"Number","value":998,"metadata":{}},
        "WC":{"type":"Number","value":519.6,"metadata":{}},
        "WD":{"type":"Number","value":-1,"metadata":{}},
        "location":{"type":"geo:json",
                    "value":{"type":"Point","coordinates":0,0},
                    "metadata":{"location":{"type":"string","value":"WGS84"}}
                    }
        }
}

This the error message :

[2017-07-18T10:01:16,448][WARN ][logstash.filters.json    ] Error parsing json {:source=>"message", :raw=>"{\"subscriptionId\":\"596db6409dd2c052b0ca6e2b\",\"data\":{\"id\":\"Sensor8\",\"type\":\"SensingDevice\",\"AZO\":{\"type\":\"Number\",\"value\":-1.07473e+09,\"metadata\":{}},\"DO\":{\"type\":\"Number\",\"value\":-999,\"metadata\":{}},\"HU\":{\"type\":\"Number\",\"value\":998,\"metadata\":{}},\"LU\":{\"type\":\"Number\",\"value\":3.48,\"metadata\":{}},\"RC\":{\"type\":\"Number\",\"value\":43.31,\"metadata\":{}},\"TC\":{\"type\":\"Number\",\"value\":998,\"metadata\":{}},\"WC\":{\"type\":\"Number\",\"value\":180.8,\"metadata\":{}},\"WD\":{\"type\":\"Number\",\"value\":-1,\"metadata\":{}},\"location\":{\"type\":\"geo:json\",\"value\":{\"type\":\"Point\",\"coordinates\":-0.168994000,5.569658},\"metadata\":{\"location\":{\"type\":\"string\",\"value\":\"WGS84\"}}}}}", :exception=>#<LogStash::Json::ParserError: Unexpected character ('5' (code 53)): was expecting double-quote to start field name
 at [Source: [B@6d425d2f; line: 1, column: 581]>}

I don't understand what is the unexpected character....all my field name start with double quote.

Any idea ?

Thanks

edit : this is my config file

  input {
    http {
        host => "0.0.0.0" # default: 0.0.0.0
        port => 55555 # default: 8080
      }
    }



filter {
   mutate  {
      gsub => [ "message","\]",""]
      gsub => [ "message","\[",""]
   }
   json{
      source => ["message"]
   }

 output { stdout { codec => rubydebug }
}
2

I think you will need to format this as an array in order to make it valid JSON.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.