Ignor incorrect json format (jsonparsefailure)

Hi, I send a log with rsyslog to Kafka and my rsyslog config incorrect, so my json is wrong in Kafka topic. now, I want to consume with logstash and i want ignor all incorrect json message and only read correct json format from kafka.

my json incorret format is :

message => {\"name"\: \"srv1"\, {\timestamp\": \"sat, 20.04.2019\",\"location\":\"datacenter\"}

this json incorrect { befor timestamp, i want ignor all this messages.
thnaks a lot.

Try to parse it with a json failure and then drop it if it fails to parse

if "_jsonparsefailure" in [tags] { drop {} }

in filter block or output?


1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.