Have logstash automatically parse any .json files

I'm planning on shipping lots of logs into logstash. Is it possible to configure logstash in such a way so that only if a file ends with .json it would go through:

json {
        source => "message"
      }

Thanks ahead!

You can do this via the file input plugin:

input {
  file {
    path => "/mydirectory/*.json"
    codec => "json"
  }
}

(Or maybe codec json_lines depending on your file)

Hope this helps!

Thanks for the response!

I actually direct everything to logstash. It just listens for port 5044 for beats. The question is, within the filter{}, what should I put to check if it’s a .json file.

Thanks ahead

If you're using filebeat you should be able to configure it to only send json files.

If you absolutely need to filter in logstash then the event should have a field with the filename in it (possibly path?). You should be able to use an if statement, something along these lines (untested)

filter {
  if [path] !~ /\.json$/ {
     drop {}
  }
  ...
}

Any help?

Thanks for the response,

I’m actually looking to filter it filebeat because I intend to do send all the logs to filebeat. It’s just that some would be JSON.

That if statement would be true if it’s not a .json file, right? If I want the condition to be true, then just replace the ! With = right?

Ahh right,

You probably then want

filter {
  if [path] =~ /\.json$/ {
     json {
        source => "message"
     }
  }
  ...
}

I’ll try it out, thanks!

Just out of curiousity, do you know why it’s bit *.json?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.