# Is there any method to parse json without quotations, kind of file in logstash

**URL:** https://discuss.elastic.co/t/is-there-any-method-to-parse-json-without-quotations-kind-of-file-in-logstash/44392
**Category:** Logstash
**Created:** [March 15, 2016, 6:33am UTC](https://discuss.elastic.co/t/is-there-any-method-to-parse-json-without-quotations-kind-of-file-in-logstash/44392 "2016-03-15T06:33:07Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Sai\_Birada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_birada/32/142367_2.png) [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)
#### Post date: [March 15, 2016, 6:33am UTC](https://discuss.elastic.co/t/is-there-any-method-to-parse-json-without-quotations-kind-of-file-in-logstash/44392/1 "2016-03-15T06:33:07Z")

</div>

I had a file which i want to parse with logstash, but its a json with out quotation marks. Is there any method to parse it?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 15, 2016, 12:31pm UTC](https://discuss.elastic.co/t/is-there-any-method-to-parse-json-without-quotations-kind-of-file-in-logstash/44392/2 "2016-03-15T12:31:24Z")

</div>

In the general case it's not easy, but if the JSON objects are sufficiently similar one might be able to use a grok filter. Show us an example message.

---

<div class="post-metadata">

### Author: ![Sai\_Birada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_birada/32/142367_2.png) [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)
#### Post date: [March 16, 2016, 5:07am UTC](https://discuss.elastic.co/t/is-there-any-method-to-parse-json-without-quotations-kind-of-file-in-logstash/44392/3 "2016-03-16T05:07:39Z")

</div>

example log:.  
Jan 3 19:29:43 atlanta1-na1-e query[2452]: { Zqlquery : { Select: { Fieldnames: [, t1, companyid, , t1, locationid, , t1, transactions, , t2, bytes] }, { FieldTypes: [U\_INT, (null), (null), U\_INT, (null), (null), U\_LONG, (null), (null), U\_LONG, (null), (null)] }, { Functionames: [COUNT, SUM] }}, { GROUP BY: { Fieldnames: [, t1, userid] }, { FieldTypes: [U\_INT, (null), (null)] }}, }  
Jan 3 19:29:43 atlanta1-na1-e query[2452]: { ZQL query time: 3.01 secs}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 16, 2016, 6:32am UTC](https://discuss.elastic.co/t/is-there-any-method-to-parse-json-without-quotations-kind-of-file-in-logstash/44392/4 "2016-03-16T06:32:20Z")

</div>

It looks like those events are not going to be very similar unless all queries made are almost the same, so parsing this with grok is going to be painful at best. You probably need a custom parser for this.

---

<div class="post-metadata">

### Author: ![Sai\_Birada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_birada/32/142367_2.png) [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)
#### Post date: [March 16, 2016, 6:35am UTC](https://discuss.elastic.co/t/is-there-any-method-to-parse-json-without-quotations-kind-of-file-in-logstash/44392/5 "2016-03-16T06:35:00Z")

</div>

Yes, these events are not similar. So any idea which custom parser can be used to handle this?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 16, 2016, 6:43am UTC](https://discuss.elastic.co/t/is-there-any-method-to-parse-json-without-quotations-kind-of-file-in-logstash/44392/6 "2016-03-16T06:43:01Z")

</div>

I imagine you'll want to write a Logstash filter plugin. If you're lucky there's a simple Ruby lexer/parser that can help with the text parsing if you don't want to hand code it.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/is-there-any-method-to-parse-json-without-quotations-kind-of-file-in-logstash/44392/7 "2017-07-06T05:06:48Z")

</div>


