# How to parse the json content using Json filter

**URL:** <https://discuss.elastic.co/t/how-to-parse-the-json-content-using-json-filter/157496>\
**Category:** Logstash\
**Created:** [November 20, 2018, 8:33am UTC](https://discuss.elastic.co/t/how-to-parse-the-json-content-using-json-filter/157496 "2018-11-20T08:33:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sanj](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@Sanj](https://discuss.elastic.co/u/Sanj)\
**Post date:** [November 20, 2018, 8:33am UTC](https://discuss.elastic.co/t/how-to-parse-the-json-content-using-json-filter/157496/1 "2018-11-20T08:33:42Z")

</div>

Hi Team,

I'm trying to parse a file containing data in Json format. Initially i tried filebeat to parse the data, but came across a discussion in this forum that logstash would be the best place to parse the nested json.

> [Architecturally should filebeat handle nested json parsing or should it be moved to logstash?](https://discuss.elastic.co/t/architecturally-should-filebeat-handle-nested-json-parsing-or-should-it-be-moved-to-logstash/59385)

So i'm using multiline filter in filebeat end and json plugin in logstash to parse the data. But I'm not able to acheive the expected result.

> {  
> agentId: "TMS",  
> apiVersion: "v2",  
> entities: [  
> {  
> agentId: "Server1",  
> name: "HouseBankID",  
> cacheManagerName: "RFT\_HouseBank\_CacheMgr",  
> attributes: {  
> Size: 21,  
> LocalHeapSize: 0,  
> CacheInMemoryMissRate: 0,  
> LocalHeapSizeInBytes: 0,  
> AverageGetTime: 0,  
> CacheHitRate: 0,  
> CacheOffHeapMissRate: 0,  
> LocalOffHeapSize: 0,  
> CacheInMemoryHitRate: 0,  
> CacheMissRate: 0,  
> CacheHitRatio: 0,  
> CacheOffHeapHitRate: 0  
> }  
> },  
> {  
> agentId: "Server2",  
> name: "HouseBankID",  
> cacheManagerName: "RFT\_HouseBank\_CacheMgr",  
> attributes: {  
> Size: 21,  
> LocalHeapSize: 0,  
> CacheInMemoryMissRate: 0,  
> LocalHeapSizeInBytes: 0,  
> AverageGetTime: 0,  
> CacheHitRate: 0,  
> CacheOffHeapMissRate: 0,  
> LocalOffHeapSize: 0,  
> CacheInMemoryHitRate: 0,  
> CacheMissRate: 0,  
> CacheHitRatio: 0,  
> CacheOffHeapHitRate: 0  
> }  
> }  
> ],  
> exceptionEntities:   
> }

This is the json I'm trying to parse.

And below is the logstash configuration I'm using for parsing this JSON.

> input {  
> beats {  
> port =\> 5044  
> }  
> }

filter{

```
mutate {
	gsub => [
		"message" , "}," , "}" 
	]
}

json {
	source => "message"
}

```

}

output{  
stdout {  
codec =\> rubydebug  
}  
}

but i'm getting "\_jsonparsefailure" while running this.

Can anyone guide me with parsing this JSON.

Since I'm new to this forum, Sorry for the bad formatting of the post.

Thank You in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 18, 2018, 8:33am UTC](https://discuss.elastic.co/t/how-to-parse-the-json-content-using-json-filter/157496/2 "2018-12-18T08:33:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.