File input doesn t read incoming Json file from web application but when modified everythnig is fine

Elastic Stack Logstash
1

I have to project in rails which have huge logs, I want to parse them in logstash and kibana, the problem is when logs do from web application logstash could not pars them but after modified them even very unused change then logstash pars them. I'm looking in logstash logs but everything is fine, I also found this issues which are completely mine but our config file is different I don't know what's wrongs could you please help me.

input {
    file {
        start_position => "beginning"
        type => "json"
        path => ["/usr/share/logstash/MPD_LOCATION/*",
                 "/usr/share/logstash/MPD_LOCATION/*/*",
                 "/usr/share/logstash/MPD_LOCATION/*/*/*",
                 "/usr/share/logstash/MPD_LOCATION/*/*/*/*",
                 "/usr/share/logstash/MPD_LOCATION/*/*/*/*/*"]
#        sincedb_path => "/dev/null"
  }
}


filter {
    mutate {
        gsub => ["message","/}+({)/", "}::{"]
    }
    mutate {
        gsub => ["message","/}+( )/", "}::"]
    }
    split {
        field => "message"
        terminator => "::"
    }
    json { source => "message" }
    mutate {
        add_field => { "uuid" => "D%{driver_id}T%{created_at}" }
        rename => {
                "[location][latitude]" => "[location][lat]"
                "[location][longitude]" => "[location][lon]"
        }
        convert => {
                "[location][lat]" => "float"
                "[location][lon]" => "float"
        }
    }
}
output {
    if ([type] == "location") {
      elasticsearch {
        hosts => "http://elasticsearch:9200"
        index => "live_locations_%{+YYYY_MM_dd}"
        manage_template => true
        template => "/usr/share/logstash/Template/live_locations.json"
        template_name => "live_locations"
        document_id => "%{uuid}"
      }
    } else if ([type] == "app_info") {
      elasticsearch {
        hosts => "http://elasticsearch:9200"
        index => "app_info_%{+YYYY_MM_dd}"
        document_id => "%{uuid}"
      }
    }
    stdout {}
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.