# Failed to Import JSON to elastic via logstash

**URL:** <https://discuss.elastic.co/t/failed-to-import-json-to-elastic-via-logstash/104093>\
**Category:** Logstash\
**Created:** [October 16, 2017, 1:35pm UTC](https://discuss.elastic.co/t/failed-to-import-json-to-elastic-via-logstash/104093 "2017-10-16T13:35:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mickey](https://avatars.discourse-cdn.com/v4/letter/m/ccd318/32.png) [@Mickey](https://discuss.elastic.co/u/Mickey)\
**Post date:** [October 16, 2017, 1:35pm UTC](https://discuss.elastic.co/t/failed-to-import-json-to-elastic-via-logstash/104093/1 "2017-10-16T13:35:44Z")

</div>

i'm new to ELK stack and i am breaking my head trying to import single line json files to elasticsearch using logstach. nothing shows up at Elasticsearch (10.10.20.13:9200/monitor/\_search?q=\*) or kibana.

my json looks like:

{"host":"\*\*\*\*\*\*\*\*\*","cpu":"2.1","disk":"0.628242","memory":"0.324597","createAt":"2017-10-03T00:18:01"}  
my config file: (after hours of searching i also added json codec & filter but with no change)

input{  
file{  
path =\> "/usr/share/logstash/log/monitor-sys-1506979201881.json"  
sincedb\_path =\> "/dev/null"  
start\_position =\> "beginning"  
}  
}  
output{  
elasticsearch {  
hosts =\>["10.10.20.13:9200"]  
index =\> ["monitor"]  
}  
stdout {  
codec =\> rubydebug  
}  
}  
Another configuration i've tried without sucsess is:

input{  
file{  
path =\> "/usr/share/logstash/log/monitor-sys-1506979201881.json"  
sincedb\_path =\> "/dev/null"  
start\_position =\> "beginning"  
type =\> "json"  
}  
}

filter{  
json {  
source =\> "message"  
}  
}  
output{  
elasticsearch {  
hosts =\>["10.10.20.13:9200"]  
index =\> ["monitor"]  
}  
stdout {  
codec =\> rubydebug  
}  
}  
the command i'm running:

/usr/share/logstash/bin/logstash -f /opt/\*\*\*\*\*/sys-monit/logstash-sys-monitor.conf --path.settings /etc/logstash --verbose --debug  
debugging produces the below result:

[https://pastebin.com/WtDtFCNs](https://pastebin.com/WtDtFCNs)

**i'd appreciate any help on that.**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2017, 1:35pm UTC](https://discuss.elastic.co/t/failed-to-import-json-to-elastic-via-logstash/104093/2 "2017-11-13T13:35:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.