# JSON Error

**URL:** <https://discuss.elastic.co/t/json-error/48788>\
**Category:** Logstash\
**Created:** [April 29, 2016, 9:08am UTC](https://discuss.elastic.co/t/json-error/48788 "2016-04-29T09:08:43Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![praveen\_siem](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\
**Post date:** [April 29, 2016, 9:08am UTC](https://discuss.elastic.co/t/json-error/48788/1 "2016-04-29T09:08:44Z")

</div>

Hello,

We are in a process of OSSEC-ELK integration. We have finished the initial installations. We are facing below issues:

When we are executing the command : **service logstash-forwarder start**

we are getting the error:

**Failed unmarshalling json: json: cannot unmarshal object into Go value of type []main.FileConfig**

and the following error as well:

**Could not load config file /etc/logstash-forwarder.conf: json: cannot unmarshal object into Go value of type []main.FileConfig**

Appreciate your support.

Best Regards-  
Praveen K

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [April 29, 2016, 9:23am UTC](https://discuss.elastic.co/t/json-error/48788/2 "2016-04-29T09:23:45Z")

</div>

Note that Logstash Forwarder is deprecated and replaced by [Filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/index.html). Since you seem to be having a new project, you might want to consider using that instead.

---

<div class="post-metadata">

**Author:** ![praveen\_siem](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\
**Post date:** [April 29, 2016, 9:52am UTC](https://discuss.elastic.co/t/json-error/48788/3 "2016-04-29T09:52:54Z")

</div>

Are you suggesting to use filebeat instead of logstash forwarder ? Will it work.?

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [April 29, 2016, 10:10am UTC](https://discuss.elastic.co/t/json-error/48788/4 "2016-04-29T10:10:59Z")

</div>

Yes, they are pretty much equivalent. But you'll need to rework your configuration file, see: [https://www.elastic.co/guide/en/beats/filebeat/current/migrating-from-logstash-forwarder.html](https://www.elastic.co/guide/en/beats/filebeat/current/migrating-from-logstash-forwarder.html)

---

<div class="post-metadata">

**Author:** ![praveen\_siem](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\
**Post date:** [April 29, 2016, 11:00am UTC](https://discuss.elastic.co/t/json-error/48788/5 "2016-04-29T11:00:15Z")

</div>

Hi Tudor,

I think the configuration file is correct and fine. When we are testing the json script, it is stating as Valid JSON.  
By the way i am putting in the code for your reference here:

```auto
{
        "network": {
                "servers": ["X.X.X.X:5000"],

                "ssl ca": "/opt/logstash-forwarder/logstash-forwarder.crt",

                "timeout": 15
        },

        "files": {

                "paths": [
                        "/var/ossec/logs/alerts/alerts.json"
                ],

                "fields": {
                        "type": "ossec-alerts"
                }
        }
}

```

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [April 29, 2016, 11:08am UTC](https://discuss.elastic.co/t/json-error/48788/6 "2016-04-29T11:08:08Z")

</div>

I think files needs to be an array of dictionaries. You only have a dictionary.

---

<div class="post-metadata">

**Author:** ![praveen\_siem](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\
**Post date:** [April 29, 2016, 11:20am UTC](https://discuss.elastic.co/t/json-error/48788/7 "2016-04-29T11:20:58Z")

</div>

Hi,

We put the multiple values in the paths, but still the same results.  
NO LUCK.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 30, 2016, 3:32pm UTC](https://discuss.elastic.co/t/json-error/48788/8 "2016-04-30T15:32:49Z")

</div>

I think you misunderstood Tudor. Please show your most recent configuration.

---

<div class="post-metadata">

**Author:** ![praveen\_siem](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\
**Post date:** [May 3, 2016, 10:01am UTC](https://discuss.elastic.co/t/json-error/48788/9 "2016-05-03T10:01:20Z")

</div>

Hello Magnus,

We have the following configuration:

{  
"network": {  
"servers": ["X.X.X.X:5000"],

```
            "ssl ca": "/opt/logstash-forwarder/logstash-forwarder.crt",

            "timeout": 15
    },

    "files": {

            "paths": [
                    "/var/ossec/logs/alerts/*.log"
            ],

            "fields": {
                    "type": "ossec-alerts"
            }
    }

```

}

And the errors what we are facing from long time is furnished below:

2016/05/03 07:07:43.629399 Failed unmarshalling json: json: cannot unmarshal object into Go value of type []main.FileConfig  
2016/05/03 07:07:43.629411 Could not load config file /etc/logstash-forwarder.conf: json: cannot unmarshal object into Go value of type []main.FileConfig

Appreciate your response.

Best Regards-  
Praveen K

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 3, 2016, 11:46am UTC](https://discuss.elastic.co/t/json-error/48788/10 "2016-05-03T11:46:15Z")

</div>

As documented, the `files` configuration option is an array:

```auto
"files": [
  {
    "paths": [
      "/var/ossec/logs/alerts/*.log"
    ],
  },
  ...
],

```

---

<div class="post-metadata">

**Author:** ![praveen\_siem](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\
**Post date:** [May 5, 2016, 8:46am UTC](https://discuss.elastic.co/t/json-error/48788/11 "2016-05-05T08:46:52Z")

</div>

Thanks magnus, it worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/json-error/48788/12 "2017-07-06T04:59:18Z")

</div>