Error parsing json in Logstash


I would like receive help to solve my problem...
I have this error for all event:
exception=>#<LogStash::Json::ParserError: Unexpected character ('-' (code 45)): Expected space separating root-level values

My event is not a json format.
I receive all messagens from beats and I split the message using ruby code.

Logstash version is 5.1.2.

My logstash filter config:

ruby {
code => "
message_array = event.get('message').split(' || ')
header_array = message_array[0].split(' - ')
event.set('timestamp', header_array[0])
event.set('servico', header_array[1])
event.set('operacao', header_array[2])
event.set('requestId', header_array[3])
body_array = message_array[1].split(' - ')
for field in body_array
result = field.split(':')
event.set(result[0], result[1])

My logstash input config:
input {
beats {
port => 5003

Complete error in logstash log file:
[2017-07-19T13:32:09,626][WARN ][logstash.filters.json ] Error parsing json {:source=>"message", :raw=>"19-07-2017 13:31:54.086 - GXXXXXXXXo - OXXXXXo - UUID || tempoResposta:265 - httpStatusResposta:200", :exception=>#<LogStash::Json::ParserError: Unexpected character ('-' (code 45)): Expected space separating root-level values
at [Source: [B@3ef62c48; line: 1, column: 4]>}

ps: UUID format is like this example "XXXXXXXXX-XXXX-XXXX-XXXXXXXX"

This problem is not happening now.

I have 5 pipelines in the same logstash and one of them didn't have an if clause in filter block.

Logstash have a behavior that if you don't put a if clause in filter block, you receive messages from others pipelines.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.