JSON carriage return

Elastic Stack Logstash
1

So by adding a physical carriage return logstash will ingest data.

My json data does not do a carriage return and \n does not work either.

Anyone have any suggestions?

2

You need to provide more information? What platform are you running on? What does your input configuration look like?

3

Im on 7.1 for ELK, sorry about that

I have noticed if I hit enter on my FILE, logstash has no issue, but the file as is does not work.

CONF FILE:

input {
file {
#type => "json"
path => "C:/Users/Chariot/Desktop/testtest_2019-06-13/countyassessmentdownload/logs/trace/*"
start_position => "beginning"
sincedb_path => "nul"
#codec => "json_lines"
#type => "data"
}
}

filter {
json {
source => "message"
#target => "message"
}
}

output {
stdout { codec => dots }
elasticsearch {
hosts => ["http://localhost:9200"]
manage_template => true
index => "testjson"
}
}

===========================================================
FILE:

[{{"ip":"108.59.63.5","pid":22759,"hops":[{"hop":1,"ip":"10.160.122.1","rtt1":"2.228 ms"},{"hop":2,"ip":"10.127.126.1","rtt1":"0.435 ms"},{"hop":3,"ip":"10.252.1.25","rtt1":"1.354 ms"},{"hop":4,"ip":"10.252.1.121","rtt1":"0.674 ms"},{"hop":5,"ip":"","rtt1":""},{"hop":6,"ip":"108.59.63.5","rtt1":"3.291 ms"}]}]

=========================================================

4

In tail mode a file input does not emit an event until it sees a line terminator.

5

Is there a way to turn that off? I am used to using CSVs

6

Not in tail mode. Perhaps read mode would suit your use case, but make sure you understand the default value of file_completed_action.

7

Well, that is not what I need.

As this is really a dictionary, Can I have it start from the first "[" and end at the last "]" * the last "]" in the line as termination?

Also, thank you for your help with this!

8

If you want to read the entire file as one event then you may be able to use a file input with

codec => multiline { pattern => "^Spalanzani" negate => true what => previous auto_flush_interval => 1 }

or if you have multiple arrays then maybe pattern => "]$"

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.