If _jsonparsefailure in [tags]


#1

My filter:

filter {
json {
source => "message"
}
}

sometimes, I see events tagged as "_jsonparsefailure", however some events (NON-JSON) are being dropped completely.

How do I output events to elasticsearch without dropping them?


(Anh) #2
output {
if "_jsonparsefailure" in [tags] {
		file {
			path => "logs/_jsonparsefailure.txt"
		}
	}
}

This config outputs failed messages to file so that you can review them later.


#3

Thank you, however it doesn't look like what I need though...

My entire logstash config:

input {
  gelf { codec => "json" }
}

filter {
  json {
    source => "message"
  }
}

output {
  elasticsearch { hosts => ["0:9200"] }
}

I need write into elasticsearch not into _jsonparsefailure.txt file.


(Magnus B├Ąck) #4

Logstash won't drop messages just because the json filter fails. However, it might drop then because ES rejects them. Check your Logstash logs to make sure that isn't the case.


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.