Check that a message is in JSON to avoid _jsonparsefailure

Elastic Stack Logstash
1

Hi,

I have a logfile, which sadly is mixed. There are JSON lines, and there are free text lines. The good news is, that there is always a line break and JSON parsing works.

Currently I do:

   if "_jsonparsefailure" in [tags] {
                    drop { }
            }

I'd like to have an earlier check like

if ( [mesage] =~ ({.*}) ) {
   json {
                        source  => "message"
                }
}
  • Just using the curly braces to qualify for parsing

Otherwise I'd directly output it into Elasticsearch. Is there a simple way to do this, to save some performance and to avoid regular parser failures?

2

Sure, you can do that. The conditional in your example needs a few adjustments but the idea is right.

if [message] =~ /^{.*}$/ {