Error decoding JSON: invalid character '.' looking for beginning of value

Elastic Stack Beats
1

My logs include JSON objects containing decimal type numeric values. Those values begin with a "." and not "0." as it appears the Filebeat JSON parser is expecting. The JSON parser complains about this by reporting the following in the "error_key":

Error decoding JSON: invalid character '.' looking for beginning of value

Can I do anything about this inside of Filebeat?

Here is an example of one such line in my log data:

{ "time": "2018-09-10T08:00:01.203", "level": "DEBUG", "logger": "RPMS.WebAPI.Filters.LogActionAttribute", "message": "Log Action: RPMS.WebAPI.Entities.LogAction", "eventProperties": {"logAction": {"logActionId":27102631,"performedByUserId":"9eea4462-880b-4961-9fd1-76cc605448f5","performedByUserName":"mainframe@urlhere.net","performedByFullName":"Mainframe Admin","controller":"MainframeItems","action":"Put","actionDescription":"Update item with item code: 1727.","url":"https://urlhere.com:8443/api/MainframeItems/1727","verb":"PUT","statusCode":204,"status":"No Content","request":{"itemTemp":172,"itemCode":1727,"BalanceOnHand":51,"weeklyMovement":4,"yearlyMovement":418,"lastYearsMovement":732,"weeksInInventory":36,"newItem":false,"dealDate":"","dealAmt":.0000,"upcCode":1254600523,"groupNumber":10,"subGroupNumber":0,"size":" 12/CT","units":12,"description":"STRIDE SPK GUM RED SING","offPack":"","buyerCode":"7","deptCode":"A","multi1":0,"base1":.00,"percent1":0,"multi2":0,"base2":.00,"percent2":0,"multi3":0,"base3":.00,"percent3":0,"multi4":0,"base4":.00,"percent4":0,"multi5":0,"base5":.00,"percent5":0,"multi6":0,"base6":.00,"percent6":0,"multi7":0,"base7":.00,"percent7":0,"multi8":0,"base8":.00,"percent8":0,"multi9":0,"base9":.00,"percent9":0,"multi10":0,"base10":.00,"percent10":0,"multi1c":0,"current1":1.37,"percent1c":45,"multi2c":0,"current2":1.33,"percent2c":43,"multi3c":0,"current3":1.29,"percent3c":41,"multi4c":0,"current4":1.23,"percent4c":39,"multi5c":0,"current5":1.15,"percent5c":34,"multi6c":0,"current6":1.13,"percent6c":33,"multi7c":0,"current7":1.07,"percent7c":29,"multi8c":0,"current8":.00,"percent8c":0,"multi9c":0,"current9":.00,"percent9c":0,"multi10c":0,"current10":.00,"percent10c":0,"catchWeight":false,"privateLabel":"","status":"","meatOrProduceItem":false,"previewItem":false,"vendorNumber":2627,"defaultbaseCost":.0000,"defaultcaseCost":9.0700,"defaultunitCost":.7558},"response":{"notice":"Response output suppressed – LogAction:LogSuccessfulMainframeResponses is false"},"performedAt":"2018-09-10T08:00:01.123505-05:00"}}, "logAction": "RPMS.WebAPI.Entities.LogAction" }

And here is that line pretty printed:

{
	"time": "2018-09-10T08:00:01.203",
	"level": "DEBUG",
	"logger": "RPMS.WebAPI.Filters.LogActionAttribute",
	"message": "Log Action: RPMS.WebAPI.Entities.LogAction",
	"eventProperties": {
		"logAction": {
			"logActionId": 27102631,
			"performedByUserId": "9eea4462-880b-4961-9fd1-76cc605448f5",
			"performedByUserName": "mainframe@urlhere.net",
			"performedByFullName": "Mainframe Admin",
			"controller": "MainframeItems",
			"action": "Put",
			"actionDescription": "Update item with item code: 1727.",
			"url": "https://urlhere.com:8443/api/MainframeItems/1727",
			"verb": "PUT",
			"statusCode": 204,
			"status": "No Content",
			"request": {
				"itemTemp": 172,
				"itemCode": 1727,
				"BalanceOnHand": 51,
				"weeklyMovement": 4,
				"yearlyMovement": 418,
				"lastYearsMovement": 732,
				"weeksInInventory": 36,
				"newItem": false,
				"dealDate": "",
				"dealAmt": .0000,
				"upcCode": 1254600523,
				"groupNumber": 10,
				"subGroupNumber": 0,
				"size": "  12/CT",
				"units": 12,
				"description": "STRIDE SPK GUM RED SING",
				"offPack": "",
				"buyerCode": "7",
				"deptCode": "A",
				"multi1": 0,
				"base1": .00,
				"percent1": 0,
				"multi2": 0,
				"base2": .00,
				"percent2": 0,
				"multi3": 0,
				"base3": .00,
				"percent3": 0,
				"multi4": 0,
				"base4": .00,
				"percent4": 0,
				"multi5": 0,
				"base5": .00,
				"percent5": 0,
				"multi6": 0,
				"base6": .00,
				"percent6": 0,
				"multi7": 0,
				"base7": .00,
				"percent7": 0,
				"multi8": 0,
				"base8": .00,
				"percent8": 0,
				"multi9": 0,
				"base9": .00,
				"percent9": 0,
				"multi10": 0,
				"base10": .00,
				"percent10": 0,
				"multi1c": 0,
				"current1": 1.37,
				"percent1c": 45,
				"multi2c": 0,
				"current2": 1.33,
				"percent2c": 43,
				"multi3c": 0,
				"current3": 1.29,
				"percent3c": 41,
				"multi4c": 0,
				"current4": 1.23,
				"percent4c": 39,
				"multi5c": 0,
				"current5": 1.15,
				"percent5c": 34,
				"multi6c": 0,
				"current6": 1.13,
				"percent6c": 33,
				"multi7c": 0,
				"current7": 1.07,
				"percent7c": 29,
				"multi8c": 0,
				"current8": .00,
				"percent8c": 0,
				"multi9c": 0,
				"current9": .00,
				"percent9c": 0,
				"multi10c": 0,
				"current10": .00,
				"percent10c": 0,
				"catchWeight": false,
				"privateLabel": "",
				"status": "",
				"meatOrProduceItem": false,
				"previewItem": false,
				"vendorNumber": 2627,
				"defaultbaseCost": .0000,
				"defaultcaseCost": 9.0700,
				"defaultunitCost": .7558
			},
			"response": {
				"notice": "Response output suppressed – LogAction:LogSuccessfulMainframeResponses is false"
			},
			"performedAt": "2018-09-10T08:00:01.123505-05:00"
		}
	},
	"logAction": "RPMS.WebAPI.Entities.LogAction"
}

Note the decimal values that begin with ".".

Also note that the JSON standard is to output without a leading zero. It would seem that the problem is with Filebeat.

2

@jlavallet I've looked at the Python, Ruby and Golang JSON parser all of them will generate an error because it cannot parse this decimal value. I suspect that Elasticsearch/Java will also refuse that.

I believe the javascript parser will allow it because it will auto convert it.

I've tested it in the javascript console.

ok = .09
0.09
ok

Also note that the JSON standard is to output without a leading zero

Where is that definition?

If I look at the JSON specification they have this formal definition of a number, and they do require something before the .

number
    int frac exp

int
    digit
    onenine digits
    '-' digit
    '-' onenine digits

digits
    digit
    digit digits

digit
    '0'
    onenine

onenine
    '1' . '9'

frac
    ""
    '.' digits

exp
    ""
    'E' sign digits
    'e' sign digits
3

@pierhugues, the specification that you posted seems to indicate that you are right. I believe I was misled that the leading zero was optional based on some other posts that I read. Anyway, your answer led me to my solution which was to use the following regular expression to reformat the data that I was being sent by a third party.

// C# code    
var valueAsString = (string) value; 
// fix floating-point values with non-leading zeros
valueAsString = Regex.Replace(valueAsString, "\\\":([\\s]*)\\.", "\": 0.");
1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.