# File Input codec =\> "json\_lines" won't work

**URL:** <https://discuss.elastic.co/t/file-input-codec-json-lines-wont-work/281196>\
**Category:** Logstash\
**Created:** [August 12, 2021, 11:46am UTC](https://discuss.elastic.co/t/file-input-codec-json-lines-wont-work/281196 "2021-08-12T11:46:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![panagiss](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@panagiss](https://discuss.elastic.co/u/panagiss)\
**Post date:** [August 12, 2021, 11:46am UTC](https://discuss.elastic.co/t/file-input-codec-json-lines-wont-work/281196/1 "2021-08-12T11:46:33Z")

</div>

I try to read from a json file but `codec=>"json_lines"` won't work, can't see any output. But when i try and set `codec=>"json"` it works and parses the data and i see the output.

So you ask me what is the format of the json file. Well the json file was records from beats that i save into a file. So the output must be **by default**  **json\_lines** as the [docs](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-file.html#plugins-outputs-file-codec) state. So i cannot see why is this happening...

Config to save file:

```auto
input{
    beats {
        port => 5044
     }
}

output{
    stdout {
       codec => rubydebug 
    }
    file{
         path => "/usr/share/logstash/config/auditbeat.json"
    }
}

```

Now here is a sample of json file:

 ![Screenshot from 2021-08-12 14-42-54](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ea817b21aef384e8679b48e0620162d69f8bf148.png)

And now here is the config file i try to read from the file:

```auto
input{
    file{
        path => "/usr/share/logstash/config/auditbeat.json"
        start_position => "beginning"
        codec => "json_lines"
    }
}

output{
    stdout {
       codec => rubydebug 
    }
}

```

That config won't print anything on the stdout, but i switch to `codec => json` it will.

---

<div class="post-metadata">

**Author:** ![panagiss](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@panagiss](https://discuss.elastic.co/u/panagiss)\
**Post date:** [August 12, 2021, 1:24pm UTC](https://discuss.elastic.co/t/file-input-codec-json-lines-wont-work/281196/2 "2021-08-12T13:24:03Z")

</div>

Also i found out that while using the `codec=>"json"` in the input file plugin, i thought it worked ok but i got this error at the begging which is related to my **filter** :

```auto
Error parsing json {:source=>"destination", :raw=>{"ip"=>"127.0.0.1", "bytes"=>0, "port"=>16443, "packets"=>0}, :exception=>java.lang.ClassCastException: class org.jruby.RubyHash cannot be cast to class org.jruby.RubyIO (org.jruby.RubyHash and org.jruby.RubyIO are in unnamed module of loader 'app'

```

Here is the updated conf with filter:

```auto
input{
    file{
        path => "/usr/share/logstash/config/auditbeat.json"
        start_position => "beginning"
        #ecs_compatibility => "v1"
        codec => "json"
    }
   
}

filter{
    json{
        source => "destination"
    }
}

output{
    stdout {
       codec => rubydebug 
    }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 12, 2021, 3:05pm UTC](https://discuss.elastic.co/t/file-input-codec-json-lines-wont-work/281196/3 "2021-08-12T15:05:26Z")

</div>

The [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-json_lines.html#_description_179) explains why json\_lines does not work with a file input. json\_lines expects a stream of lines separated by newlines. The file input strips the newline from a line, so the json\_lines codec never thinks it has seen the end of the line.

The ClassCastException suggests to me that you do not need the json filter, that the [destination] field was already parsed by the json codec. You can see that [destination] is a RubyHash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 9, 2021, 3:06pm UTC](https://discuss.elastic.co/t/file-input-codec-json-lines-wont-work/281196/4 "2021-09-09T15:06:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.