# Ignor incorrect json format (jsonparsefailure)
**URL:** https://discuss.elastic.co/t/ignor-incorrect-json-format-jsonparsefailure/177728
**Category:** Logstash
**Created:** [April 20, 2019, 8:06pm UTC](https://discuss.elastic.co/t/ignor-incorrect-json-format-jsonparsefailure/177728 "2019-04-20T20:06:53Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@arp220](https://discuss.elastic.co/u/arp220)
#### Post date: [April 20, 2019, 8:06pm UTC](https://discuss.elastic.co/t/ignor-incorrect-json-format-jsonparsefailure/177728/1 "2019-04-20T20:06:53Z")
Hi, I send a log with rsyslog to Kafka and my rsyslog config incorrect, so my json is wrong in Kafka topic. now, I want to consume with logstash and i want ignor all incorrect json message and only read correct json format from kafka.
my json incorret format is :
```auto
message => {\"name"\: \"srv1"\, {\timestamp\": \"sat, 20.04.2019\",\"location\":\"datacenter\"}
```
this json incorrect `{` befor timestamp, i want ignor all this messages.
thnaks a lot.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 20, 2019, 8:56pm UTC](https://discuss.elastic.co/t/ignor-incorrect-json-format-jsonparsefailure/177728/2 "2019-04-20T20:56:53Z")
Try to parse it with a json failure and then drop it if it fails to parse
```
if "_jsonparsefailure" in [tags] { drop {} }
```
---
### Author:  [@arp220](https://discuss.elastic.co/u/arp220)
#### Post date: [April 20, 2019, 9:06pm UTC](https://discuss.elastic.co/t/ignor-incorrect-json-format-jsonparsefailure/177728/3 "2019-04-20T21:06:19Z")
in filter block or output?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 20, 2019, 9:25pm UTC](https://discuss.elastic.co/t/ignor-incorrect-json-format-jsonparsefailure/177728/4 "2019-04-20T21:25:57Z")
filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 18, 2019, 9:26pm UTC](https://discuss.elastic.co/t/ignor-incorrect-json-format-jsonparsefailure/177728/5 "2019-05-18T21:26:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.