# "json\_error": "Error decoding JSON: invalid character 'S' looking for beginning of value

**URL:** https://discuss.elastic.co/t/json-error-error-decoding-json-invalid-character-s-looking-for-beginning-of-value/189124
**Category:** Beats
**Tags:** filebeat
**Created:** [July 5, 2019, 2:26pm UTC](https://discuss.elastic.co/t/json-error-error-decoding-json-invalid-character-s-looking-for-beginning-of-value/189124 "2019-07-05T14:26:03Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![iukea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iukea/32/49083_2.png) [@iukea](https://discuss.elastic.co/u/iukea)
#### Post date: [July 5, 2019, 2:26pm UTC](https://discuss.elastic.co/t/json-error-error-decoding-json-invalid-character-s-looking-for-beginning-of-value/189124/1 "2019-07-05T14:26:04Z")

</div>

Hello Currently getting the error  
`json_error": "Error decoding JSON: invalid character 'S' looking for beginning of value`

Full error

```auto
     "input_type": "log",
      "json_error": "Error decoding JSON: invalid character 'S' looking for beginning of value",
      "log": "Starting server on port 5000/udp",
      "offset": 1106,
      "source": "/data/ciscoasa/log/ciscoasa.log",
      "type": "CiscoASA_Threats"

```

File beat YML is

```
paths:
- /data/ciscoasa/log/ciscoasa.log
input_type: log
document_type: CiscoASA_Threats

json.keys_under_root: true
json.add_error_key: true
json.message_key: log

```

Example of log file in /data/ciscoasa/log/ciscoasa.log

```auto
Starting server on port 5000/udp
Using selector: EpollSelector
Starting server on port 8443/tcp, use <Ctrl-C> to stop
{'timestamp': '2019-07-04T21:26:48.784247', 'src_ip': '37.1.205.153', 'payload_printable': '"GET / HTTP/1.1" 200 -'}
{'timestamp': '2019-07-04T21:26:51.789395', 'src_ip': '37.1.205.153', 'payload_printable': 'Request timed out: timeout('The read operation timed out',)'}
{'timestamp': '2019-07-04T21:29:23.410621', 'src_ip': '37.1.205.153', 'payload_printable': '"GET / HTTP/1.1" 200 -'}
{'timestamp': '2019-07-04T21:29:26.413366', 'src_ip': '37.1.205.153', 'payload_printable': 'Request timed out: timeout('The read operation timed out',)'}
{'timestamp': '2019-07-05T05:08:12.746232', 'src_ip': '178.128.194.144', 'payload_printable': '"GET / HTTP/1.1" 200 -'}
{'timestamp': '2019-07-05T05:08:15.749377', 'src_ip': '178.128.194.144', 'payload_printable': 'Request timed out: timeout('The read operation timed out',)'}
{'timestamp': '2019-07-05T07:14:55.251841', 'src_ip': '184.105.139.67', 'payload_printable': '"GET / HTTP/1.1" 200 -'}
Stopping server.
Starting server on port 5000/udp
Using selector: EpollSelector
Starting server on port 8443/tcp, use <Ctrl-C> to stop

```

Need some words of wisdom if any of you guys/ girls can help 😃

---

<div class="post-metadata">

### Author: ![faec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faec/32/46988_2.png) [@faec](https://discuss.elastic.co/u/faec)
#### Post date: [July 5, 2019, 10:20pm UTC](https://discuss.elastic.co/t/json-error-error-decoding-json-invalid-character-s-looking-for-beginning-of-value/189124/2 "2019-07-05T22:20:01Z")

</div>

Yes, the problem is that only some of your log lines are JSON -- in particular, "`Starting server on port 5000/udp`" is not valid JSON, and the JSON reader notices as soon as it tries to read the first character ('S').

A simple solution would be to add `json.ignore_decoding_error: true` to your configuration, but this would throw out all JSON errors, not just the ones caused by other types of output. A more robust alternative would be to filter out the lines that shouldn't use the JSON parser, e.g. in your `filebeat.inputs` configuration you could add:

```auto
include_lines: ['^\{']

```

however this version doesn't work for me as that regular expression is incorrect and I can't figure out why right now (I also tried `'^{'`, `'^\\{'` and `'^\\\{'` XD), maybe someone else can jump in with the right syntax to match an open-brace at the start of a line

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 2, 2019, 10:20pm UTC](https://discuss.elastic.co/t/json-error-error-decoding-json-invalid-character-s-looking-for-beginning-of-value/189124/3 "2019-08-02T22:20:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.