# Can not parse valid JSON message in LogStash

**URL:** <https://discuss.elastic.co/t/can-not-parse-valid-json-message-in-logstash/250791>\
**Category:** Elasticsearch\
**Created:** [October 2, 2020, 1:27pm UTC](https://discuss.elastic.co/t/can-not-parse-valid-json-message-in-logstash/250791 "2020-10-02T13:27:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dencowboy](https://avatars.discourse-cdn.com/v4/letter/d/c67d28/32.png) [@dencowboy](https://discuss.elastic.co/u/dencowboy)\
**Post date:** [October 2, 2020, 1:27pm UTC](https://discuss.elastic.co/t/can-not-parse-valid-json-message-in-logstash/250791/1 "2020-10-02T13:27:00Z")

</div>

I'm using ElasticSearch 7.7 and logstash 7.9.2.

This is my configuration:

```
input {
  kinesis {
    kinesis_stream_name => "xxx-${ENV}"
    application_name => "xxx-${ENV}"
    region => "eu-west-1"
    tags => ["log"]
  }
}

filter {
  if "log" in [tags] {
    json {
        source => "message"
    }
    mutate {
      add_field => {
        "appName" => "xxx"
        "sourceType" => "kinesis"
        "logstashParser" => "logstash_kinesis_xxx_log"
      }
    }
  }
}

output {
  if "log" in [tags] {
    elasticsearch {
      hosts => "https://${ES}:443"
      index => "ki-xxx-log-%{+YYYY.MM.dd}"
      # https://github.com/elastic/logstash/issues/11094
      ilm_enabled => false
    }
  }
}

```

Now I see data in my Kibana but it is not parsing the JSON message while the message is a valid json (using jsonlint):

The output looks like below so the fields in my message are not parsed

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/4/3410567eb2acfc3a9458697b67e861dbc2a79d94.png)

Any idea what I'm doing wrong or how I can debug this further? I can not find the id of the message in my logstash-plain.log file.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 30, 2020, 1:27pm UTC](https://discuss.elastic.co/t/can-not-parse-valid-json-message-in-logstash/250791/2 "2020-10-30T13:27:02Z")

</div>

Closed on October 30, 2020, 1:27pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.