Json array input producing _jsonparsefailure

[Scott_Newby]

We're trying to import a json file that starts as an array (starts with [ and ends in ].

A truncated input file:

[
  {
    "uri": "uri/feature",
    "id": "idvalue",
    "keyword": "Feature",
    "name": "name",
    "description": "description",
    "line": 2,
    "comments": [
      {
        "value": "#encoding: utf-8",
        "line": 1
      }
    ]
}
]

My ls config file:

input{
   file {
      path => ["path to json file"]
      start_position => "beginning"
      codec => "json"
    }
}
output{
   stdout{ codec=>"rubydebug"} 
}

Produces this type of error:

"path" => "path to json file",
          "host" => "host name",
      "@version" => "1",
       "message" => "    ]\r",
    "@timestamp" => 2018-07-13T19:39:04.064Z,
          "tags" => [
        [0] "_jsonparsefailure"

I'm pretty sure this is related t the file starting out as an array, just trying to find out the best way to handle this situation.

[Badger]

@Scott_Newby

"message" => " ]\r"

It's not related to it being an array, it's related to it consuming the file one line at a time. You should use a multiline codec on the input. In order to consume the entire file as one event I would match on a pattern that does not occur in the file.

codec => multiline { pattern => "Spalanzani" negate => true what => "previous" auto_flush_interval => 2 }

[Scott_Newby]

@Badger - thanks for the reply that should help us out. Appreciate it.