How to parse the json content using Json filter

Elastic Stack Logstash
1

Hi Team,

I'm trying to parse a file containing data in Json format. Initially i tried filebeat to parse the data, but came across a discussion in this forum that logstash would be the best place to parse the nested json.

Architecturally should filebeat handle nested json parsing or should it be moved to logstash?

So i'm using multiline filter in filebeat end and json plugin in logstash to parse the data. But I'm not able to acheive the expected result.

{
agentId: "TMS",
apiVersion: "v2",
entities: [
{
agentId: "Server1",
name: "HouseBankID",
cacheManagerName: "RFT_HouseBank_CacheMgr",
attributes: {
Size: 21,
LocalHeapSize: 0,
CacheInMemoryMissRate: 0,
LocalHeapSizeInBytes: 0,
AverageGetTime: 0,
CacheHitRate: 0,
CacheOffHeapMissRate: 0,
LocalOffHeapSize: 0,
CacheInMemoryHitRate: 0,
CacheMissRate: 0,
CacheHitRatio: 0,
CacheOffHeapHitRate: 0
}
},
{
agentId: "Server2",
name: "HouseBankID",
cacheManagerName: "RFT_HouseBank_CacheMgr",
attributes: {
Size: 21,
LocalHeapSize: 0,
CacheInMemoryMissRate: 0,
LocalHeapSizeInBytes: 0,
AverageGetTime: 0,
CacheHitRate: 0,
CacheOffHeapMissRate: 0,
LocalOffHeapSize: 0,
CacheInMemoryHitRate: 0,
CacheMissRate: 0,
CacheHitRatio: 0,
CacheOffHeapHitRate: 0
}
}
],
exceptionEntities:
}

This is the json I'm trying to parse.

And below is the logstash configuration I'm using for parsing this JSON.

input {
beats {
port => 5044
}
}

filter{

mutate {
	gsub => [
		"message" , "}," , "}" 
	]
}

json {
	source => "message"
}

}

output{
stdout {
codec => rubydebug
}
}

but i'm getting "_jsonparsefailure" while running this.

Can anyone guide me with parsing this JSON.

Since I'm new to this forum, Sorry for the bad formatting of the post.

Thank You in advance.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.