# Error with Windows log

**URL:** <https://discuss.elastic.co/t/error-with-windows-log/1693>\
**Category:** Logstash\
**Created:** [June 2, 2015, 8:52am UTC](https://discuss.elastic.co/t/error-with-windows-log/1693 "2015-06-02T08:52:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sdclmb](https://avatars.discourse-cdn.com/v4/letter/s/e95f7d/32.png) [@Sdclmb](https://discuss.elastic.co/u/Sdclmb)\
**Post date:** [June 2, 2015, 8:52am UTC](https://discuss.elastic.co/t/error-with-windows-log/1693/1 "2015-06-02T08:52:25Z")

</div>

hello,

Let me explain the situation : I'm using 2 different server, one for my Rsyslog server and an onther for the ELK stack. I collect logs from Windows servers/computer on my Rsyslog server using Event to syslog. And then i transfer the logs to the ELK server via json. My problem is with some Windows' logs logstash seems to not interpret well the log. But with some other Windows' logs it work, and with Linux computer it work too.

In the source of the log a got a "message" before the actual log, it's strang. ![](https://sea2.discourse-cdn.com/elastic/uploads/default/original/9/7/9753339498fba0a76d6a5da8613b84bfbf293273.png)

![](https://sea2.discourse-cdn.com/elastic/uploads/default/original/c/f/cfb1fbd6ee4e1bc448ad7d389e821ed49d2df932.png)

And i'm using this json script on my Rsyslog server : [https://gist.github.com/untergeek/0373ee85a41d03ae1b78](https://gist.github.com/untergeek/0373ee85a41d03ae1b78)

Thanks guys for taking a look at this for me.  
Very much appreciate your time and suggestions. 😄

PS : Sorry if my english is not that good

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 2, 2015, 10:08am UTC](https://discuss.elastic.co/t/error-with-windows-log/1693/2 "2015-06-02T10:08:58Z")

</div>

It looks like there's a [json codec](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-json.html) (or [filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html)) missing somewhere, or the JSON text is broken and can't be parsed. Are all messages entering Logstash via the same UDP port 10514 listener? Um, wait. Is this how rsyslog produces the JSON messages?

```
template(name="ls_json"
         type="list"
         option.json="on") {
           constant(value="{")
             constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339")
             constant(value="\",\"@version\":\"1")
             constant(value="\",\"message\":\"") property(name="msg")
             constant(value="\",\"host\":\"") property(name="hostname")
             constant(value="\",\"severity\":\"") property(name="syslogseverity-text")
             constant(value="\",\"facility\":\"") property(name="syslogfacility-text")
             constant(value="\",\"programname\":\"") property(name="programname")
             constant(value="\",\"procid\":\"") property(name="procid")
           constant(value="\"}\n")
         }

```

I don't know rsyslog, but it looks like this won't work for values containing double quotes. The result will be exactly what you're seeing (broken JSON that can't be parsed, resulting in Logstash falling back to a plain codec).

---

<div class="post-metadata">

**Author:** ![Sdclmb](https://avatars.discourse-cdn.com/v4/letter/s/e95f7d/32.png) [@Sdclmb](https://discuss.elastic.co/u/Sdclmb)\
**Post date:** [June 2, 2015, 11:40am UTC](https://discuss.elastic.co/t/error-with-windows-log/1693/3 "2015-06-02T11:40:31Z")

</div>

Yes, i am using this exact template to forward syslog message to Logstash, and i olso sending log via the port 10514.

Oh ok so i'll see if i can replace double quotes in the log by simple, thanks 😄

---

<div class="post-metadata">

**Author:** ![Sdclmb](https://avatars.discourse-cdn.com/v4/letter/s/e95f7d/32.png) [@Sdclmb](https://discuss.elastic.co/u/Sdclmb)\
**Post date:** [June 9, 2015, 2:29pm UTC](https://discuss.elastic.co/t/error-with-windows-log/1693/4 "2015-06-09T14:29:51Z")

</div>

hello,

Sorry to bother you again but after many many search i can't find the solution to my problem and i was wondering if you had it.

My other problem is that i got \_jsonparsefailure and i d'ont know why. I'm using this conf file : [https://gist.github.com/untergeek/0373ee85a41d03ae1b78](https://gist.github.com/untergeek/0373ee85a41d03ae1b78). I'm using this to too :  
mutate {  
gsub =\> ["message","[\#]","/"]  
}  
to replace \ by /, but i still have jsonfailure.

Again sorry to bother you but i can't find the answer to my problem.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 9, 2015, 2:50pm UTC](https://discuss.elastic.co/t/error-with-windows-log/1693/5 "2015-06-09T14:50:57Z")

</div>

I don't understand what your gsub is supposed to do. There's nothing wrong with the backslashes in the message payload. I have no idea how to get rsyslog to send properly escaped JSON. You might want to reconsider your strategy here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:38am UTC](https://discuss.elastic.co/t/error-with-windows-log/1693/6 "2017-07-06T05:38:01Z")

</div>