# Issue parsing azure platform properties

**URL:** <https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042>\
**Category:** Elastic Agent\
**Created:** [May 1, 2023, 8:35pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042 "2023-05-01T20:35:15Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![intsec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/intsec/32/72137_2.png) [@intsec](https://discuss.elastic.co/u/intsec)\
**Post date:** [May 1, 2023, 8:35pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042/1 "2023-05-01T20:35:15Z")

</div>

I am also working with support on this but was hoping to get a faster response here. Anyone using Azure Eventhubs forAppServiceHTTPLogs, I can get the logs to come in but I need to parse the azure.platform.properties field and I have a custom pipeline with the first processor stating that the field is JSON but when I review the logs in discovery I am getting this error.

`Processor "json" with tag "" in pipeline "logs-azure.platformlogs@custom" failed with message "Unexpected character ('C' (code 67)): was expecting double-quote to start field name\n at [Source: (org.elasticsearch.common.io.stream.ByteBufferStreamInput); line: 1, column: 3]"`

Here is the field as it comes in

```auto
{
"Cookie": "-",
"CsBytes": 1249,
"SPort": "443",
"TimeTaken": 15,
"Referer": "-",
"ScWin32Status": "0",
"CIp": "1.1.1.18",
"Result": "Success",
"CsHost": "REDACTED",
"ScBytes": 606,
"CsUriQuery": "id=2&returnToUrl=/Contacts/Contacts&X-ARR-LOG-ID=73f9ec26-b6c5-400f-9e56-d97bac83aca2",
"CsMethod": "GET",
"ComputerName": "REDACTED",
"UserAgent": "Mozilla/5.0+AppleWebKit/537.36+(KHTML,+like+Gecko;+compatible;+bingbot/2.0;++http://www.bing.com/bingbot.htm)+Chrome/103.0.5060.134+Safari/537.36",
"ScSubStatus": "0",
"CsUriStem": "/Contacts/Contact/Details",
"CsUsername": "-",
"ScStatus": 302
}

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 1, 2023, 10:06pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042/2 "2023-05-01T22:06:52Z")

</div>

Hi @intsec  
Is the field really "pretty" JSON (multiple lines) most of the parsers are expecting compact / ndjson perhaps that is the issue.

Can you see the raw logs? Can you configure the logs to be compact / ndjson?

Just something to check

---

<div class="post-metadata">

**Author:** ![intsec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/intsec/32/72137_2.png) [@intsec](https://discuss.elastic.co/u/intsec)\
**Post date:** [May 2, 2023, 12:10pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042/3 "2023-05-02T12:10:21Z")

</div>

I have the JSON listed, it looks to be JSON when I look at it.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 2, 2023, 2:16pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042/4 "2023-05-02T14:16:20Z")

</div>

Yes it is JSON

a) This is pretty JSON (i.e. multiple lines)

```auto
{
  "foo" : "bar"
}

```

b) This is compact / [ndjson](https://clue.engineering/2018/introducing-reactphp-ndjson) single line per document,

```auto
{ "foo" : "bar" }

```

Most the streaming parsers are looking for type b that is what I am asking...

---

<div class="post-metadata">

**Author:** ![intsec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/intsec/32/72137_2.png) [@intsec](https://discuss.elastic.co/u/intsec)\
**Post date:** [May 2, 2023, 2:28pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042/5 "2023-05-02T14:28:54Z")

</div>

> [@intsec](#):
>
> ```auto
> {
> "Cookie": "-",
> "CsBytes": 1249,
> "SPort": "443",
> "TimeTaken": 15,
> "Referer": "-",
> "ScWin32Status": "0",
> "CIp": "1.1.1.18",
> "Result": "Success",
> "CsHost": "REDACTED",
> "ScBytes": 606,
> "CsUriQuery": "id=2&returnToUrl=/Contacts/Contacts&X-ARR-LOG-ID=73f9ec26-b6c5-400f-9e56-d97bac83aca2",
> "CsMethod": "GET",
> "ComputerName": "REDACTED",
> "UserAgent": "Mozilla/5.0+AppleWebKit/537.36+(KHTML,+like+Gecko;+compatible;+bingbot/2.0;++http://www.bing.com/bingbot.htm)+Chrome/103.0.5060.134+Safari/537.36",
> "ScSubStatus": "0",
> "CsUriStem": "/Contacts/Contact/Details",
> "CsUsername": "-",
> "ScStatus": 302
> }
> 
> ```

Ahh ok, I understand you now and I have seen this being talked about and people were saying you need to somehow change it to ndjson before it hits elasticsearch? If so I am not sure how to do this.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 2, 2023, 2:52pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042/6 "2023-05-02T14:52:57Z")

</div>

I would check with the Azure forum, docs etc to see if you can emit in compact form

Or in our integration is there a flag, which exact integration are you using...

---

<div class="post-metadata">

**Author:** ![intsec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/intsec/32/72137_2.png) [@intsec](https://discuss.elastic.co/u/intsec)\
**Post date:** [May 2, 2023, 2:54pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042/7 "2023-05-02T14:54:17Z")

</div>

Azure Logs under the Platform Logs/

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 2, 2023, 2:55pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042/8 "2023-05-02T14:55:11Z")

</div>

> [@intsec](#):
>
> Azure Logs under the Platform Logs/

can you be more specific ..

We have Filebeat and Agent, Which exact Integration,Which Exact Version, Screenshot etc. ... We can help more when you are very specific...

We answer 100s of questions...help us .. help you...

Sharing Configurations (sanitized is also helpful)

---

<div class="post-metadata">

**Author:** ![intsec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/intsec/32/72137_2.png) [@intsec](https://discuss.elastic.co/u/intsec)\
**Post date:** [May 2, 2023, 3:07pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042/9 "2023-05-02T15:07:19Z")

</div>

Certainly,  
We are using only agent, and its the Azure Logs integration

 ![elastic-screenshot1](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c915742165d2a844a3c6a2fd55e986687ba87ad8.jpeg)

and the HTTPLogs come in through the Platform Logs section under the Azure Logs integration configuration

 ![elastic-screenshot2](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8e7cbce979aec58033079c1d047e540eca570cc9.jpeg)

 ![elastic-screenshot3](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d5f1201f6d80afdaf7779c25fb4ca009b3c84b5e.jpeg)

We are using the integration version 1.5.13 for Azure Logs. Elastic v 8.5.3

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 2, 2023, 3:32pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042/10 "2023-05-02T15:32:09Z")

</div>

Ok cool thanks

Interestingly the HTTP logs you are showing do not look like the examples in the docs here

> **[Azure platform logs | Elastic docs](https://docs.elastic.co/integrations/azure/platformlogs)**
>
> Azure platform logs integration

The log you are showing looks to be a log from an HTTP Server (as you note)

The easiest thing would probably be to track that down and have them adjust their output to ndjson (which is very common these days)

Not to say you can not fix this but you are going to put in a multi-line filter etc, which is more complex .. and might interfere with other types of logs...

Perhaps a friend of mine might have an idea

@hemantmalik Any Thoughts

---

<div class="post-metadata">

**Author:** ![intsec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/intsec/32/72137_2.png) [@intsec](https://discuss.elastic.co/u/intsec)\
**Post date:** [May 2, 2023, 4:35pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042/11 "2023-05-02T16:35:51Z")

</div>

When I started the ticket with Elastic on this they had said they were looking into adding support for the HTTPLogs that come from Azure HTTP service which I have a client that uses for their web application. So that could be why you don't see examples specifically for the HTTP Logs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2023, 4:36pm UTC](https://discuss.elastic.co/t/issue-parsing-azure-platform-properties/332042/12 "2023-05-30T16:36:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.