[Help Request] HTTP Input with Multiline JSON Post Data

Elastic Stack Logstash
1

I'm trying to parse a newline separated HTTPS POST data feed, each line is a JSON object. I also have an output to elastic search.

Right now I'm trying to use the json_lines codec and that doesn't seem to be working at all. If I use the json code, that seems to only catch the first object in the POST body.

The HTTPS input plugin is working, just can't get the data to read in and parse into elastic search correctly at this point.

Thank you if anyone can help!

2

Well, ok, I think I figured it out.

The plugin supports it, but you need to make sure that you aren't sending the JSON header with the request. This seems to override the codec you set in the config.

Also, I put the codec in both the input and output as json_lines. This seems to have worked for the time being.

1 Like