# Filebeat ignoring closing bracket {

**URL:** <https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 30, 2023, 9:31am UTC](https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312 "2023-11-30T09:31:51Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Venkata\_Raja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkata_raja/32/114264_2.png) [@Venkata\_Raja](https://discuss.elastic.co/u/Venkata_Raja)\
**Post date:** [November 30, 2023, 9:31am UTC](https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312/1 "2023-11-30T09:31:51Z")

</div>

Hi Team,,

I have a multiline JSON message in a file , I used custom log integration to parse it with below multiline config.

multiline:  
match: after  
negate: true  
pattern: '^{'

I was getting all the data except last closing } , due to which my logstash json filter is failing, can someone help please

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [November 30, 2023, 10:13am UTC](https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312/2 "2023-11-30T10:13:18Z")

</div>

Hi @Venkata_Raja,

Welcome back! Have you tried amending the regex pattern to include the closing bracket?

---

<div class="post-metadata">

**Author:** ![Venkata\_Raja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkata_raja/32/114264_2.png) [@Venkata\_Raja](https://discuss.elastic.co/u/Venkata_Raja)\
**Post date:** [November 30, 2023, 10:29am UTC](https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312/3 "2023-11-30T10:29:12Z")

</div>

I am unable to get correct pattern to do that.  
My log file contain single event only that will be rotated every 5 minutes. That single event contains 2500 lines under a single JSOn object comprising multiple child JSON objects.

Can you please help either with the pattern or with process on how to add } at the end of message field in logstash so that I can parse JSON

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [November 30, 2023, 1:41pm UTC](https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312/4 "2023-11-30T13:41:57Z")

</div>

Can you share a sample log message that you want to match?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 30, 2023, 1:47pm UTC](https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312/5 "2023-11-30T13:47:54Z")

</div>

> [@Venkata\_Raja](#):
>
> Can you please help either with the pattern or with process on how to add } at the end of message field in logstash so that I can parse JSON

You need to share your logstash configuration.

But if you do not have the last `}` in your file, this means that there is no line break after it and filebeat didn't read this line.

What is the source of the data the filebeat is reading? Do you have any control over it to change what is being written in the file?

---

<div class="post-metadata">

**Author:** ![Venkata\_Raja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkata_raja/32/114264_2.png) [@Venkata\_Raja](https://discuss.elastic.co/u/Venkata_Raja)\
**Post date:** [November 30, 2023, 1:56pm UTC](https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312/6 "2023-11-30T13:56:29Z")

</div>

Yes , you are right, there is only single event in log file - it will rotate once it has new log entry,so just 1 log at a time and we don't have any line break or new line at the end. That is why agent is ignoring last line that is } .  
I can't modify source file as some 3rd party vendor is producing it.  
Any way to add } at the end of message value using logstash filters so that it can be parsed as JSON.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 30, 2023, 2:14pm UTC](https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312/7 "2023-11-30T14:14:31Z")

</div>

> [@Venkata\_Raja](#):
>
> Any way to add } at the end of message value using logstash filters so that it can be parsed as JSON.

As mentioned, you need to share your Logstash configuration.

---

<div class="post-metadata">

**Author:** ![Venkata\_Raja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkata_raja/32/114264_2.png) [@Venkata\_Raja](https://discuss.elastic.co/u/Venkata_Raja)\
**Post date:** [November 30, 2023, 2:27pm UTC](https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312/8 "2023-11-30T14:27:24Z")

</div>

Hi Leandro,

As an overview, I am just getting data from beats input (agent integration), using JSON filter on message field (which is failing) and sending output to Elasticsearch  
Thank you

```auto

input { 
  beats {
    port => 5044
  }
}
filter {
  json {
    source => "message"
  }
}
output { 
   elasticsearch { hosts => ["localhost:9200"] } 
}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 30, 2023, 2:55pm UTC](https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312/9 "2023-11-30T14:55:16Z")

</div>

You can try to add the following filter **before** your `json` filter.

```auto
    mutate {
        update => {
            "message" => "%{message}}"
        }
    }

```

---

<div class="post-metadata">

**Author:** ![Venkata\_Raja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkata_raja/32/114264_2.png) [@Venkata\_Raja](https://discuss.elastic.co/u/Venkata_Raja)\
**Post date:** [November 30, 2023, 3:06pm UTC](https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312/10 "2023-11-30T15:06:19Z")

</div>

Thank you so much. It worked

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2023, 5:06pm UTC](https://discuss.elastic.co/t/filebeat-ignoring-closing-bracket/348312/11 "2023-12-28T17:06:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.