JSON carriage return

So by adding a physical carriage return logstash will ingest data.

My json data does not do a carriage return and \n does not work either.

Anyone have any suggestions?

You need to provide more information? What platform are you running on? What does your input configuration look like?

Im on 7.1 for ELK, sorry about that

I have noticed if I hit enter on my FILE, logstash has no issue, but the file as is does not work.


input {
file {
#type => "json"
path => "C:/Users/Chariot/Desktop/testtest_2019-06-13/countyassessmentdownload/logs/trace/*"
start_position => "beginning"
sincedb_path => "nul"
#codec => "json_lines"
#type => "data"

filter {
json {
source => "message"
#target => "message"

output {
stdout { codec => dots }
elasticsearch {
hosts => ["http://localhost:9200"]
manage_template => true
index => "testjson"


[{{"ip":"","pid":22759,"hops":[{"hop":1,"ip":"","rtt1":"2.228 ms"},{"hop":2,"ip":"","rtt1":"0.435 ms"},{"hop":3,"ip":"","rtt1":"1.354 ms"},{"hop":4,"ip":"","rtt1":"0.674 ms"},{"hop":5,"ip":"","rtt1":""},{"hop":6,"ip":"","rtt1":"3.291 ms"}]}]


In tail mode a file input does not emit an event until it sees a line terminator.

Is there a way to turn that off? I am used to using CSVs

Not in tail mode. Perhaps read mode would suit your use case, but make sure you understand the default value of file_completed_action.

Well, that is not what I need.

As this is really a dictionary, Can I have it start from the first "[" and end at the last "]" * the last "]" in the line as termination?

Also, thank you for your help with this!

If you want to read the entire file as one event then you may be able to use a file input with

codec => multiline { pattern => "^Spalanzani" negate => true what => previous auto_flush_interval => 1 }

or if you have multiple arrays then maybe pattern => "]$"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.