How to make multiple lines of json file to single line json file

Elastic Stack Logstash
1

I am having issue with multiple lines json file.

With single line json file able to process the file with below configuration.
logstash.conf

input {
	beats{
		port =>	"5044"
		codec => json
	}
}


filter {
   		
	json {
        source => "message"
      }
	mutate {
	 remove_field => [ "@version","source"]
	}
	
      mutate { 
	   rename => { "[data][item]" => "item" }
	}
	
	split{
		field => "[item]"
	}

	prune { 
		whitelist_names =>  "item" 
	}
		

	ruby {
        code => '
			event.get("item").each { |k, v|
			event.set(k,v)
			}
			event.remove("item")
			'
		}
}

output {
	if "_rubyexception" not in [tags]{
		elasticsearch {
			hosts => ["localhost:9200"]
			index => "samplejsonforlogstash5"
			 document_type => "json"
			document_id => "%{id}"
			doc_as_upsert => true
			action => "update"
		}
		 stdout{}
	}
}

filebeat.yml

filebeat.inputs:
- type: log
  paths: C:/sample json files/json format/json.json
output.logstash:
  hosts: ["localhost:5044"]

json file

{"source":"logs","data":{"item":[{"id":"101","crud":"Create","fields":{"partid":"101"},"logistics":{"weight":"6.10","height":"4"}},{"id":"102","crud":"Create","fields":{"partid":"102"},"logistics":{"weight":"0.62","height":"3"}},{"id":"103","crud":"Create","fields":{"partid":"103"},"logistics":{"weight":"4.88","height":"2"}}]}}

in this way it is getting stored in logstash. Everything working fine with single line of json.

[
    {
        "logistics": {
            "weight": "6.10",
            "height": "4"
        },
        "fields": {
            "partid": "101"
        },
        "crud": "Create",
        "id": "101"
    },
    {
        "logistics": {
            "weight": "0.62",
            "height": "3"
        },
        "fields": {
            "partid": "102"
        },
        "crud": "Create",
        "id": "102"
    },
    {
        "logistics": {
            "weight": "4.88",
            "height": "2"
        },
        "fields": {
            "partid": "103"
        },
        "crud": "Create",
        "id": "103"
    }
]

Now the issue is i am getting json in multi line, how can i convert to single line json file in logstash. Please help me out to solve this issue.

Just i want to convert multi line to single line json in logstash.

Here is multi line json file

{
  "source": "logs",
  "data": {
    "item": [
      {
        "id": "101",
        "crud": "Create",
        "fields": {
          "partid": "101"
        },
        "logistics": {
          "weight": "6.10",
          "height": "4"
        }
      },
      {
        "id": "102",
        "crud": "Create",
        "fields": {
          "partid": "102"
        },
        "logistics": {
          "weight": "0.62",
          "height": "3"
        }
      },
      {
        "id": "103",
        "crud": "Create",
        "fields": {
          "partid": "103"
        },
        "logistics": {
          "weight": "4.88",
          "height": "2"
        }
      }
    ]
  }
}
2

See this thread.

3

@Badger Thanks for reply. Here i am having multi line with multiple events - multiline patter will not work. I just want to make my json content to single line, can you please give some advise how to convert from multiple lines to single line content like below

Single line content
''''

{"source":"logs","data":{"item":[{"id":"101","crud":"Create","fields":{"partid":"101"},"logistics":{"weight":"6.10","height":"4"}},{"id":"102","crud":"Create","fields":{"partid":"102"},"logistics":{"weight":"0.62","height":"3"}},{"id":"103","crud":"Create","fields":{"partid":"103"},"logistics":{"weight":"4.88","height":"2"}}]}}
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.