# Import json

**URL:** https://discuss.elastic.co/t/import-json/119690
**Category:** Logstash
**Created:** [February 13, 2018, 6:45pm UTC](https://discuss.elastic.co/t/import-json/119690 "2018-02-13T18:45:46Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Pororo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pororo/32/27711_2.png) [@Pororo](https://discuss.elastic.co/u/Pororo)
#### Post date: [February 13, 2018, 6:45pm UTC](https://discuss.elastic.co/t/import-json/119690/1 "2018-02-13T18:45:47Z")

</div>

Hi, I was trying to import json file to ES thru logstash but it seems something wrong with my operation.

Here is my json sample:

{"jurHash":"112256955","txnId":"vipus0E48BEC71E28C81F","ts":"2018-01-29 00:03:30.085 +0000","result.statusMessage":"Success","durationMillis":2,"requestId":"9999","extUserId":"testto demo","result.status":"0000","wsdlVersion":"1\_8","operation":"createUser","\_id":"car4be-w2-tc.1517184210085.15247464"}

And this is my config:

input {  
file {  
path =\> "/Users/apple/Desktop/SampleData/event.log"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
codec =\> json\_lines{  
}  
}  
}  
filter {  
json{  
source =\> "message"  
#target =\>"doc"  
remove\_field =\> ["message"]  
}  
}  
output {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "realmockdata"  
document\_type =\> "eventdata"  
}  
stdout {}  
}

I can start up logstash successfully but it just stuck in "Pipeline running".

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 13, 2018, 9:52pm UTC](https://discuss.elastic.co/t/import-json/119690/2 "2018-02-13T21:52:26Z")

</div>

> [@Pororo](#):
>
> it just stuck in "Pipeline running".

Sounds like it is waiting for more input.

You might have better luck using `stdin` instead of a file input.

---

<div class="post-metadata">

### Author: ![Pororo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pororo/32/27711_2.png) [@Pororo](https://discuss.elastic.co/u/Pororo)
#### Post date: [February 13, 2018, 10:26pm UTC](https://discuss.elastic.co/t/import-json/119690/3 "2018-02-13T22:26:27Z")

</div>

That is one way, but my json file has hundreds of items like that. So I think I have to use "file".

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 13, 2018, 10:36pm UTC](https://discuss.elastic.co/t/import-json/119690/4 "2018-02-13T22:36:12Z")

</div>

Nope, `cat $file | logstash ....` and you are good.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 13, 2018, 10:36pm UTC](https://discuss.elastic.co/t/import-json/119690/5 "2018-02-13T22:36:43Z")

</div>

I cannot speak to the question you asked, but if you use a json\_lines codec on the input, you do not need a json filter. The line gets parsed as JSON on input.

---

<div class="post-metadata">

### Author: ![Pororo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pororo/32/27711_2.png) [@Pororo](https://discuss.elastic.co/u/Pororo)
#### Post date: [February 14, 2018, 7:09am UTC](https://discuss.elastic.co/t/import-json/119690/6 "2018-02-14T07:09:00Z")

</div>

I successfully imported the json to ES but it seems it did not do mappings for each attributes of my json. It only has the whole bunch of message.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 14, 2018, 7:09am UTC](https://discuss.elastic.co/t/import-json/119690/7 "2018-03-14T07:09:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
