I also expected json_lines to work, but not even this trivial example does:
$ cat test.config
input { stdin { codec => json_lines } }
output { stdout { codec => rubydebug } }
$ cat data
{
"foo": "bar"
}
$ /opt/logstash/bin/logstash -f test.config < data
Logstash startup completed
{
"message" => "{",
"tags" => [
[0] "_jsonparsefailure"
],
"@version" => "1",
"@timestamp" => "2015-09-23T05:47:37.345Z",
"host" => "lnxmagnusbk"
}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Stdin codec=><LogStash::Codecs::JSONLines charset=>"UTF-8">, debug=>false>
Error: string not matched {:level=>:error}
Logstash shutdown completed
Reading the documentation I find it quite ambiguous, and comparing the source code with that of the json codec doesn't really help either. It seems the difference between json and json_lines is that the latter will wait for a newline character before attempting to unmarshal the data while the former just grabs and unmarshals whatever it can get its hands on.