# JSON carriage return

**URL:** <https://discuss.elastic.co/t/json-carriage-return/186130>\
**Category:** Logstash\
**Created:** [June 17, 2019, 6:06pm UTC](https://discuss.elastic.co/t/json-carriage-return/186130 "2019-06-17T18:06:35Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![jbro](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@jbro](https://discuss.elastic.co/u/jbro)\
**Post date:** [June 17, 2019, 6:06pm UTC](https://discuss.elastic.co/t/json-carriage-return/186130/1 "2019-06-17T18:06:35Z")

</div>

So by adding a physical carriage return logstash will ingest data.

My json data does not do a carriage return and \n does not work either.

Anyone have any suggestions?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 17, 2019, 6:12pm UTC](https://discuss.elastic.co/t/json-carriage-return/186130/2 "2019-06-17T18:12:41Z")

</div>

You need to provide more information? What platform are you running on? What does your input configuration look like?

---

<div class="post-metadata">

**Author:** ![jbro](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@jbro](https://discuss.elastic.co/u/jbro)\
**Post date:** [June 17, 2019, 8:21pm UTC](https://discuss.elastic.co/t/json-carriage-return/186130/3 "2019-06-17T20:21:18Z")

</div>

Im on 7.1 for ELK, sorry about that

I have noticed if I hit enter on my FILE, logstash has no issue, but the file as is does not work.

CONF FILE:

input {  
file {  
#type =\> "json"  
path =\> "C:/Users/Chariot/Desktop/testtest\_2019-06-13/countyassessmentdownload/logs/trace/\*"  
start\_position =\> "beginning"  
sincedb\_path =\> "nul"  
#codec =\> "json\_lines"  
#type =\> "data"  
}  
}

filter {  
json {  
source =\> "message"  
#target =\> "message"  
}  
}

output {  
stdout { codec =\> dots }  
elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]  
manage\_template =\> true  
index =\> "testjson"  
}  
}

===========================================================  
FILE:

[{{"ip":"108.59.63.5","pid":22759,"hops":[{"hop":1,"ip":"10.160.122.1","rtt1":"2.228 ms"},{"hop":2,"ip":"10.127.126.1","rtt1":"0.435 ms"},{"hop":3,"ip":"10.252.1.25","rtt1":"1.354 ms"},{"hop":4,"ip":"10.252.1.121","rtt1":"0.674 ms"},{"hop":5,"ip":"_","rtt1":"_"},{"hop":6,"ip":"108.59.63.5","rtt1":"3.291 ms"}]}]

=========================================================

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 17, 2019, 8:44pm UTC](https://discuss.elastic.co/t/json-carriage-return/186130/4 "2019-06-17T20:44:04Z")

</div>

In tail mode a file input does not emit an event until it sees a line terminator.

---

<div class="post-metadata">

**Author:** ![jbro](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@jbro](https://discuss.elastic.co/u/jbro)\
**Post date:** [June 17, 2019, 9:28pm UTC](https://discuss.elastic.co/t/json-carriage-return/186130/5 "2019-06-17T21:28:08Z")

</div>

Is there a way to turn that off? I am used to using CSVs

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 17, 2019, 9:37pm UTC](https://discuss.elastic.co/t/json-carriage-return/186130/6 "2019-06-17T21:37:00Z")

</div>

Not in tail mode. Perhaps [read](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#_read_mode) mode would suit your use case, but make sure you understand the default value of [file\_completed\_action](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-file_completed_action).

---

<div class="post-metadata">

**Author:** ![jbro](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@jbro](https://discuss.elastic.co/u/jbro)\
**Post date:** [June 17, 2019, 9:46pm UTC](https://discuss.elastic.co/t/json-carriage-return/186130/7 "2019-06-17T21:46:59Z")

</div>

Well, that is not what I need.

As this is really a dictionary, Can I have it start from the first "[" and end at the last "]" \* the last "]" in the line as termination?

Also, thank you for your help with this!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 17, 2019, 10:14pm UTC](https://discuss.elastic.co/t/json-carriage-return/186130/8 "2019-06-17T22:14:08Z")

</div>

If you want to read the entire file as one event then you may be able to use a file input with

```
codec => multiline { pattern => "^Spalanzani" negate => true what => previous auto_flush_interval => 1 }

```

or if you have multiple arrays then maybe pattern =\> "]$"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 15, 2019, 10:14pm UTC](https://discuss.elastic.co/t/json-carriage-return/186130/9 "2019-07-15T22:14:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.