Json array input producing _jsonparsefailure

We're trying to import a json file that starts as an array (starts with [ and ends in ].

A truncated input file:

    "uri": "uri/feature",
    "id": "idvalue",
    "keyword": "Feature",
    "name": "name",
    "description": "description",
    "line": 2,
    "comments": [
        "value": "#encoding: utf-8",
        "line": 1

My ls config file:

   file {
      path => ["path to json file"]
      start_position => "beginning"
      codec => "json"
   stdout{ codec=>"rubydebug"} 

Produces this type of error:

"path" => "path to json file",
          "host" => "host name",
      "@version" => "1",
       "message" => "    ]\r",
    "@timestamp" => 2018-07-13T19:39:04.064Z,
          "tags" => [
        [0] "_jsonparsefailure"

I'm pretty sure this is related t the file starting out as an array, just trying to find out the best way to handle this situation.

It's not related to it being an array, it's related to it consuming the file one line at a time. You should use a multiline codec on the input. In order to consume the entire file as one event I would match on a pattern that does not occur in the file.

codec => multiline { pattern => "Spalanzani" negate => true what => "previous" auto_flush_interval => 2 }
1 Like

@Badger - thanks for the reply that should help us out. Appreciate it.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.