Json codec vs json filter in file input

Elastic Stack Logstash
1

I have certain log format:

<....> [....] - [{...},{...},{...}].

With multi line codec and grok patterns, I was able to extract above into <a> [b] - c
Here c is [{...},{...},{...}] including the square brackets []

Now, when I tried to parse fields inside json object by applying json filter on c, I got a _jsonparsefailure. This is my config with json filter:

filter {
  json{
     source => c
  }
}

But, when my log format is just [{...},{...},{...}], I was able to apply json codec and successfully parse the json fields inside it without any failures.

Any suggestion how I can parse json fields inside <....> [....] - [{...},{...},{...}] formatted logs ?

2

Did the Logstash logs contain anything about why it wasn't able to parse the string as JSON?

3

Thanks for the reply @magnusbaeck . From the debug logs, it looks like target option is necessary for json filter.
I got this warning message not specifying target option.

Parsed JSON object/hash requires a target configuration option

But when I specify the target option, I had to rename the fields based on my needs.

4

From the debug logs, it looks like target option is necessary for json filter.

If the parsed string returns a non-object, yes. In your case the JSON string contains an array.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.