Failed to execute action logstash message=>"Expected one of [ \\t\\r\\n], \"#\", \"{\" at line 9, column 8 (byte 62) after filter {\n json "

Elastic Stack Logstash
1

I am new to the Elastic stack and tried using the json filter plugin to parse kibana's logs. But adding the filter started throwing this error -

Failed to execute action logstash  message=>"Expected one of [ \\t\\r\\n], \"#\", \"{\" at line 9, column 8 (byte 62) after filter {\n  json "

Here is my logstash.conf -

      input {
        beats {
          port => "5044"
        }
      }

      filter {
        
        json => { 
           source => "message" 
           target => "kibanaLog"
           skip_on_invalid_json => true
          }
        # my other filters.. 
      }

      output { 
        elasticsearch { 
          hosts => "http://elasticsearch.elk:9200"
          index => "new-index"
          action => "create"
          doc_as_upsert => true
        } 
      }

Not sure why Logstash is unable to recognize the json filter plugin.

2

Hello @Hemabh_Ravee
Welcome to elastic community :slight_smile: !!!

There is a small typo just remove " =>" in json line under filter

 json { 
           source => "message" 
           target => "kibanaLog"
           skip_on_invalid_json => true
          }

Keep Posted!!! Thanks !!!

1 Like
3

Wow I can't believe that's what I was missing. Thanks a lot! @sudhagar_ramesh

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.