Error in command prompt:
{
"@timestamp" => 2018-03-09T14:18:26.524Z,
"tags" => [
[0] "_grokparsefailure"
],
"json_message" => "input : {"
}
{
"@timestamp" => 2018-03-09T14:18:26.524Z,
"tags" => [
[0] "_grokparsefailure"
],
"json_message" => "text : what is Laura Abimbola contact"
}
{
"@timestamp" => 2018-03-09T14:18:26.524Z,
"tags" => [
[0] "_grokparsefailure"
],
"json_message" => "}"
}
What i want to do:
-
get rid of the grok parse error
-
the way my json message is displayed above isn't how i want it. Instead I want it to display as:
json_message => input :{ "text" : "what is Laura Abimbola contact" }
for each field within my json_message -
when i go to kibana i want it to show me all the fields in json_message as:
json_message.input
json_message.id
etc.
Help would be greatly appreciated as i'm still a newbie when it comes to logstash, elasticssearch, and kibana, Thanks in advance.
The Following is my configuration file:
input {
file {
path => ["C:\logstash-6.2.2\conversation_stats\conversation_stats.json"]
start_position => "beginning"
sincedb_path => "/dev/null"
ignore_older => 0
}
}
filter{
grok{
match=>{"message" => "%{DATA:_id}, \s+%{DATA:clientCode}, \s+%{DATA:conversationID}, \s+%{DATA:employeeID}, \s+%{DATA:entities}, \s+%{DATA:input}, \s+%{DATA:intents}, \s+%{DATA:locale}"}
}
if[message]!="(null)"{
json_encode{
source=>"message"
target=>"json_message"
}
}
mutate{remove_field=>["message","path", "host", "@version"]}
mutate{
gsub=>["json_message","\\t",""]
gsub=>["json_message","\n",""]
gsub=>["json_message","[\\]",""]
gsub=>["json_message","[\",]",""]
}
}
output{
stdout {codec=>rubydebug}
elasticsearch{
action =>"index"
hosts =>["localhost:9200"]
index =>"test"
}
}
Here is some sample json from my json file:
{
"_id" : ObjectId("5a2b18500623f9"),
"clientCode" : "tk",
"conversationId" : "c01b73b6-7055817a661b",
"employeeId" : "3898",
"entities" : [
{
"entity" : "benefits",
"location" : [
NumberInt("290"),
NumberInt("209")
],
"value" : "insurance",
"confidence" : NumberInt("10")
}
],
"input" : {
"text" : "where can i find my insurance claims"
},
"intents" : [
{
"intent" : "claims_inquiry",
"confidence" : 0.8324913501739502
}
],
"locale" : "en-ca"
}