# How to parse jason in logstash

**URL:** <https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691>\
**Category:** Logstash\
**Created:** [September 4, 2015, 2:31pm UTC](https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691 "2015-09-04T14:31:27Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Navneet\_Mathpal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/navneet_mathpal/32/3677_2.png) [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\
**Post date:** [September 4, 2015, 2:31pm UTC](https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691/1 "2015-09-04T14:31:27Z")

</div>

Hi All,

I am able to parse simple json file which is having one doc in one line  
ex:  
{"name":"name1",address1:"address1"}  
{"name2":"name2", "address2" : "address2"}

but If I am having json format like below how can I parse that

[{"firstname":"name1","fastname":"name2"}][{"address1":"address1","address2":"address2"}]

any idea ?

Thanks 😃

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 4, 2015, 11:31pm UTC](https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691/2 "2015-09-04T23:31:02Z")

</div>

I'd try grokking the two [] sets as json1 and json2 and then combine them after that, if you want them in a single message that is.

---

<div class="post-metadata">

**Author:** ![Navneet\_Mathpal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/navneet_mathpal/32/3677_2.png) [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\
**Post date:** [September 5, 2015, 4:23am UTC](https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691/3 "2015-09-05T04:23:39Z")

</div>

Thanks @warkolm  
But the problem is when I am trying to parse the simple json with once doc/line then its working fine..but when json file having two or more doc/line  
like :  
[{"name":"name1",address1:"address1"}][{"name":"name1",address1:"address1"}]  
It is reading the first json and without reading the second json doc , it is directly coming to the second line..

I am using simple config file

input  
{  
file  
{  
path =\> "G:/data/sample.json"  
codec =\> "json"  
start\_position =\> "beginning"  
sincedb\_path =\> "G:/data/data1.sincedb"  
}  
}  
filter  
{  
json {

```
source => "message"
} 

```

}  
output  
{  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 5, 2015, 8:32am UTC](https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691/4 "2015-09-05T08:32:25Z")

</div>

Yes, we understand the problem. And our suggestion is that you use a grok filter to split the line in two fields that each can be parsed as valid JSON.

```
filter {
  grok {
    match => [
      "message",
      "^\[%{GREEDYDATA:json1}\]\[%{GREEDYDATA:json2}\]$"
    ]
  }
  json {
    source => "json1"]
    remove_field => ["json1"]
  }
  json {
    source => "json2"]
    remove_field => ["json2"]
  }
}

```

This assumes that the sequence "][" never appears inside the JSON data. It also only works for lines with two arrays with a single JSON object each.

---

<div class="post-metadata">

**Author:** ![Navneet\_Mathpal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/navneet_mathpal/32/3677_2.png) [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\
**Post date:** [September 7, 2015, 11:48am UTC](https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691/5 "2015-09-07T11:48:04Z")

</div>

Thank you @mangnusbaeck

one query is that : I have a json file having around 1000 records, at the end it does not contain new line character , so Logstash is not reading anything till the time I am explicitly putting an "ENTER (key)" there.  
how can I overcome with this problem ?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 7, 2015, 11:54am UTC](https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691/6 "2015-09-07T11:54:37Z")

</div>

I don't think there's a way around that, at least not if you want the stateful file reading (i.e. it can be interrupted and will continue where it left off) that you get with the file input. If you can use the exec input you can just cat the file and add an extra newline.

---

<div class="post-metadata">

**Author:** ![Navneet\_Mathpal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/navneet_mathpal/32/3677_2.png) [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\
**Post date:** [September 8, 2015, 6:01am UTC](https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691/7 "2015-09-08T06:01:02Z")

</div>

Hi Magnus,

Is there any way that , while reading the file I can put end line character from logstash only ?  
Because it would be very difficult to put end line character in file manually in production environment .

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 8, 2015, 6:39am UTC](https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691/8 "2015-09-08T06:39:53Z")

</div>

I have nothing to add to what I wrote before.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:29am UTC](https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691/9 "2017-07-06T05:29:48Z")

</div>