Error parsing json but data still thrown to elastic

Elastic Stack Logstash
1

Hi there,
i want to ask about this error. anyone know what this error is trying to tell ?

exception=>java.lang.ClassCastException: class org.jruby.RubyHash cannot be cast to class org.jruby.RubyIO (org.jruby.RubyHash and org.jruby.RubyIO are in unnamed module of loader 'app'

this is my config pipeline related to json filter
image

fyi, i use v 7.13 and my data is like nested json. so it's look like this

{
    "xxxxxx": "cccc",
    "data" : {
         "sasasas": "eiwqo"
 }
}

thanks

2

It is telling you that your field is not JSON. With this configuration

input { generator { count => 1 lines => [ '' ] } }
output { stdout { codec => rubydebug { metadata => false } } }
filter {
    mutate { add_field => { "[data][sasasas]" => "eiwqo" } }
    json { source => "data" target => "data" }
}

the json filter will produce this error

Error parsing json {:source=>"data", :raw=>{"sasasas"=>"eiwqo"}, :exception=>#<Java::JavaLang::ClassCastException: class org.jruby.RubyHash cannot be cast to class org.jruby.RubyIO (org.jruby.RubyHash and org.jruby.RubyIO are in unnamed module of loader 'app')>}

Check what the ":raw" data is in your error message. I think the exception is thrown here in JrJackson.

3

Not json? Hmmm but i'm quite sure the data is a valid json. I was validated it in some json validation online sites

4

The exception message includes the data that is expected to be JSON. What does that message show?

5

it says "Error parsing json source => "data" ". i can't show you the full log because it contains sensitive data. the error line is just both of this

Error parsing json {:source=>"data"

:exception=>java.lang.ClassCastException: class org.jruby.RubyHash cannot be cast to class org.jruby.RubyIO (org.jruby.RubyHash and org.jruby.RubyIO are in unnamed module of loader 'app'

but strangely, the raw data on field data are still parsed. all of these fields come from data

image

6

so it's start from grok pattern. in original raw data, it look like this
(some other data in log) responseBody=[{"responsecode":"00","data": { "name": "xxx"}}]

and in grok pattern i made like this
%{TIMESTAMP}.......(some other pattern) ResponseBody=\[%GREEDYDATA:responseBody}\]

so it resulting a field named responseBody and the value will look like this
{"xxxxxx":"xxx","data":{"xxx","dsda":"xxx"}}

it should be a valid json right?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.