### Author:  [@Magnuss](https://discuss.elastic.co/u/Magnuss)
#### Post date: [May 12, 2021, 8:20pm UTC](https://discuss.elastic.co/t/how-to-deal-with-brackets-json-input-filter/272848/1 "2021-05-12T20:20:32Z")
Hi there,
I'm trying to figure out how to deal with brackets in logstash. The code is as following:
```auto
{
"test1": "text",
"images": [
"https://test2.com/images/I/test.jpg",
"https://test2.com/images/I/test.jpg",
"https://test2.com/images/I/test.jpg",
"https://test2.com/images/I/test.jpg",
"https://test2.com/images/I/test.jpg",
"https://test2.com/images/I/test.jpg",
"https://test2.com/images/I/test.jpg"
],
"test2": "text",
"test": 4.8
}
```
Any idea how to parse this in a proper way so i wont get errors?
```auto
{:error=>#, :data=>"]["}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 12, 2021, 8:41pm UTC](https://discuss.elastic.co/t/how-to-deal-with-brackets-json-input-filter/272848/2 "2021-05-12T20:41:51Z")
> [@Magnuss](#):
>
> `"]["`
That is not valid JSON, so a parser error is expected. What does your configuration look like? Are you reading a file? Is the JSON pretty printed?
---
### Author:  [@Magnuss](https://discuss.elastic.co/u/Magnuss)
#### Post date: [May 12, 2021, 9:47pm UTC](https://discuss.elastic.co/t/how-to-deal-with-brackets-json-input-filter/272848/3 "2021-05-12T21:47:33Z")
```auto
input {
file {
path => "/var/log/logstash/test.json"
codec => json
start_position => "beginning"
}
}
output {
elasticsearch {
index => "test"
hosts => ["https://192.168.2.6:9200"]
cacert => "/etc/logstash/certs/logstash.pem"
ssl_certificate_verification => false
user => "test"
password => "test"
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 12, 2021, 10:01pm UTC](https://discuss.elastic.co/t/how-to-deal-with-brackets-json-input-filter/272848/4 "2021-05-12T22:01:26Z")
Is a single JSON object spread across multiple lines?
---
### Author:  [@Magnuss](https://discuss.elastic.co/u/Magnuss)
#### Post date: [May 12, 2021, 10:05pm UTC](https://discuss.elastic.co/t/how-to-deal-with-brackets-json-input-filter/272848/5 "2021-05-12T22:05:00Z")
No it's actually not
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 12, 2021, 10:11pm UTC](https://discuss.elastic.co/t/how-to-deal-with-brackets-json-input-filter/272848/6 "2021-05-12T22:11:15Z")
Then somewhere in your file you have a line that contains `"]["`, which would be expected to cause that error.
---
### Author:  [@Magnuss](https://discuss.elastic.co/u/Magnuss)
#### Post date: [May 12, 2021, 10:28pm UTC](https://discuss.elastic.co/t/how-to-deal-with-brackets-json-input-filter/272848/7 "2021-05-12T22:28:30Z")
Hmm strange because the only brackets in the file are the brackets of the field images:
```auto
[2021-05-13T00:00:37,436][ERROR][logstash.codecs.json][main][08ae9b307c2d0f73d6caf27e682f549d737fbda856d1ad084aa68cedaff5eb62] JSON parse error, original data now in message field {:error=>#, :data=>"]["}
```
I didn't restart logstash after changing the config file. I have restarted it and tried again but no errors occur but also the data is not coming into elastic.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 12, 2021, 11:33pm UTC](https://discuss.elastic.co/t/how-to-deal-with-brackets-json-input-filter/272848/8 "2021-05-12T23:33:28Z")
The in-memory sincedb (which records how much of the file logstash has processed) is persisted across restarts by default. You will need to append data to the file, or else use `sincedb_path => "/dev/null"`
---
### Author:  [@Magnuss](https://discuss.elastic.co/u/Magnuss)
#### Post date: [May 13, 2021, 11:02am UTC](https://discuss.elastic.co/t/how-to-deal-with-brackets-json-input-filter/272848/9 "2021-05-13T11:02:15Z")
Oke i figured out that the error was occured of the other index. But it still leaves me with the issue.
If i completely remove the json file and add new data to it it starts with [and ends with] do i need to remove these brackets or do i need to use another codec or something?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 10, 2021, 11:02am UTC](https://discuss.elastic.co/t/how-to-deal-with-brackets-json-input-filter/272848/10 "2021-06-10T11:02:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.