If _jsonparsefailure in [tags]

Elastic Stack Logstash
1

My filter:

filter {
json {
source => "message"
}
}

sometimes, I see events tagged as "_jsonparsefailure", however some events (NON-JSON) are being dropped completely.

How do I output events to elasticsearch without dropping them?

1 Like
2 
output {
if "_jsonparsefailure" in [tags] {
		file {
			path => "logs/_jsonparsefailure.txt"
		}
	}
}

This config outputs failed messages to file so that you can review them later.

3

Thank you, however it doesn't look like what I need though...

My entire logstash config:

input {
  gelf { codec => "json" }
}

filter {
  json {
    source => "message"
  }
}

output {
  elasticsearch { hosts => ["0:9200"] }
}

I need write into elasticsearch not into _jsonparsefailure.txt file.

4

Logstash won't drop messages just because the json filter fails. However, it might drop then because ES rejects them. Check your Logstash logs to make sure that isn't the case.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.