"}`
`[2025-11-24T13:41:49,244][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=>0.91}`
`[2025-11-24T13:41:49,270][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=>"main"}`
`[2025-11-24T13:41:49,275][INFO][filewatch.observingtail][main][68ac931e1786c2696b752503a1676572958c90062ac0ffd25b57534347010225] START, creating Discoverer, Watch with file and sincedb collections`
`[2025-11-24T13:41:49,286][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>``}`
2. No index is getting created (curl localhost:9200/demo-index001/\_search?pretty=true)
`{"` **`error`** `" : {"root_cause" : [{"type" : "index_not_found_exception","reason" : "no such index [demo-index001]","resource.type" : "index_or_alias","resource.id" : "demo-index001","index_uuid" : "na","index" : "demo-index001"}],"type" : "index_not_found_exception","reason" : "no such index [demo-index001]","resource.type" : "index_or_alias","resource.id" : "demo-index001","index_uuid" : "na","index" : "demo-index001"},"status" : 404}`
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [November 24, 2025, 11:44am UTC](https://discuss.elastic.co/t/json-file-input-to-and-viewing-in-logstash-console/383608/2 "2025-11-24T11:44:38Z")
> [@dashelastic](#):
>
> ```auto
> elasticsearch {
> hosts => ["http://localhost:9200"]
> data_stream => "false"
> index => "demo-index001"
>
> }
>
> ```
If you don't specify username/pass in the connection string. you will access to ES as built-in `logstash_system` user (Elastic Jedi Order will correct me) which is visible in Kibana/ES.
> "index\_not\_found\_exception","reason" : "no such index [demo-index001]"
If you don't have created that index, you should:
- manually create index&template
- use power user, such as elastic or which is created by yourself in Kibana, with `create_index` privileges. I wouldn't assign that role to `logstash_system`
---
### Author:  [@dashelastic](https://discuss.elastic.co/u/dashelastic)
#### Post date: [November 24, 2025, 2:11pm UTC](https://discuss.elastic.co/t/json-file-input-to-and-viewing-in-logstash-console/383608/3 "2025-11-24T14:11:52Z")
Thanks for the inputs @Rios but tweaking the input.conf and using a different json filed helped but currently facing _ **\_jsonparsefailure** _ error
# input.conf
```auto
input {
file {
path => ["/savedqueries001.json"]
start_position => "beginning"
sincedb_path => "NUL"
}
}
filter {
json { source => "message" }
mutate {
remove_field => ["@timestamp", "path", "host", "@version","[event][original]"]
}
}
output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => ["http://localhost:9200"]
data_stream => "false"
index => "demo-index001"
}
}
```
> **json file**
>
> {
> "items": [
> {
> "id": "4kjba",
> "description": "osquery run",
> "displayName": "osquery",
> "compartmentId": "owsda",
> "timeCreated": "2025-10-23T12:48:31.397Z",
> "timeUpdated": "2025-10-23T12:48:31.397Z",
> "lifecycleState": "ACTIVE",
> "locks": null,
> "lifecycleDetails": null,
> "freeformTags": {},
> "definedTags": {
> "Oracle-Tags": {
> "CreatedBy": "mancom",
> "CreatedOn": "2025-10-23T12:48:31.252Z"
> }
> },
> "systemTags": {}
> },
> {
> "id": "ibyvq",
> "description": null,
> "displayName": "Memory Usage",
> "query": "SELECT \* FROM table;",
> "compartmentId": "piwca",
> "timeCreated": "2024-08-03T10:08:54.555Z",
> "timeUpdated": "2024-08-03T10:08:54.555Z",
> "lifecycleState": "ACTIVE",
> "locks": null,
> "lifecycleDetails": null,
> "freeformTags": {},
> "definedTags": {
> "Oracle-Tags": {
> "CreatedBy": "gun",
> "CreatedOn": "2024-08-03T10:08:54.467Z"
> }
> },
> "systemTags": {}
> },
> {
> "id": "tmjaqma",
> "description": null,
> "displayName": "Process Open Sockets",
> "compartmentId": "iwca",
> "timeCreated": "2024-08-03T09:59:35.843Z",
> "timeUpdated": "2024-08-03T09:59:35.843Z",
> "lifecycleState": "ACTIVE",
> "locks": null,
> "lifecycleDetails": null,
> "freeformTags": {},
> "definedTags": {
> "Oracle-Tags": {
> "CreatedBy": "pra-com",
> "CreatedOn": "2024-08-03T09:59:35.568Z"
> }
> },
> "systemTags": {}
> }
> ],
> "locks": null
> }
> **error from console**
>
> [2025-11-24T19:26:11,738][WARN][logstash.filters.json][main][a68c1c4c2d95cb646a9dada960cc34bb73fe5ff2933a274b4e1f8ba616a82aa2] Error parsing json {:source=\>"message", :raw=\>" "timeCreated": "2025-10-23T12:48:31.397Z",\r", :exception=\>#\ at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 27]\>}
> [2025-11-24T19:26:11,738][WARN][logstash.filters.json][main][a68c1c4c2d95cb646a9dada960cc34bb73fe5ff2933a274b4e1f8ba616a82aa2] Error parsing json {:source=\>"message", :raw=\>" "compartmentId": "owsda",\r", :exception=\>#\ at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 29]\>}
> [2025-11-24T19:26:11,743][WARN][logstash.filters.json][main][a68c1c4c2d95cb646a9dada960cc34bb73fe5ff2933a274b4e1f8ba616a82aa2] Error parsing json {:source=\>"message", :raw=\>" "description": "osquery run",\r", :exception=\>#\ at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 27]\>}
>
> ..
>
> ..
>
> ..
>
> {
> "event" =\> {},
> "log" =\> {
> "file" =\> {
> "path" =\> "/savedqueries001.json"
> }
> },
> "message" =\> " {\r",
> "tags" =\> [
> [0] "\_jsonparsefailure"
> ]
> }
> {
> "event" =\> {},
> "log" =\> {
> "file" =\> {
> "path" =\> "/savedqueries001.json"
> }
> },
> "message" =\> " "locks": null,\r",
> "tags" =\> [
> [0] "\_jsonparsefailure"
> ]
> }
> {
> "event" =\> {},
> "log" =\> {
> "file" =\> {
> "path" =\> "/savedqueries001.json"
> }
> },
> "message" =\> " },\r",
> "tags" =\> [
> [0] "\_jsonparsefailure"
> ]
> }
> {
> "event" =\> {},
> "log" =\> {
> "file" =\> {
> "path" =\> "/savedqueries001.json"
> }
> },
> "message" =\> " "compartmentId": "piwca",\r",
> "tags" =\> [
> [0] "\_jsonparsefailure"
> ]
> }
> {
> "event" =\> {},
> "log" =\> {
> "file" =\> {
> "path" =\> "../savedqueries001.json"
> }
> },
> "message" =\> " "Oracle-Tags": {\r",
> "tags" =\> [
> [0] "\_jsonparsefailure"
> ]
> }
> {
> "event" =\> {},
> "log" =\> {
> "file" =\> {
> "path" =\> "/savedqueries001.json"
> }
> },
> "message" =\> " "id": "tmjaqma",\r",
> "tags" =\> [
> [0] "\_jsonparsefailure"
> ]
> }
> **Desired output**
>
> {
> id: 4kjba,
> description: osquery run,
> displayName: osquery,
> compartmentId: owsda,
> timeCreated: 2025-10-23T12:48:31.397Z,
> timeUpdated: 2025-10-23T12:48:31.397Z,
> lifecycleState: ACTIVE,
> locks: null,
> lifecycleDetails: null,
> freeformTags: {},
> definedTags: {
> Oracle-Tags: {
> CreatedBy: mancom,
> CreatedOn: 2025-10-23T12:48:31.252Z
> }
> },
> systemTags: {}
> },
> {
> id: ibyvq,
> description: null,
> displayName: Memory Usage,
> query: SELECT \* FROM table;,
> compartmentId: piwca,
> timeCreated: 2024-08-03T10:08:54.555Z,
> timeUpdated: 2024-08-03T10:08:54.555Z,
> lifecycleState: ACTIVE,
> locks: null,
> lifecycleDetails: null,
> freeformTags: {},
> definedTags: {
> Oracle-Tags: {
> CreatedBy: gun,
> CreatedOn: 2024-08-03T10:08:54.467Z
> }
> },
> systemTags: {}
> },
> {
> id: tmjaqma,
> description: null,
> displayName: Process Open Sockets,
> compartmentId: iwca,
> timeCreated: 2024-08-03T09:59:35.843Z,
> timeUpdated: 2024-08-03T09:59:35.843Z,
> lifecycleState: ACTIVE,
> locks: null,
> lifecycleDetails: null,
> freeformTags: {},
> definedTags: {
> Oracle-Tags: {
> CreatedBy: pra-com,
> CreatedOn: 2024-08-03T09:59:35.568Z
> }
> },
> systemTags: {}
> }
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 24, 2025, 5:49pm UTC](https://discuss.elastic.co/t/json-file-input-to-and-viewing-in-logstash-console/383608/4 "2025-11-24T17:49:11Z")
If your JSON object is split across multiple lines you will need to use a multiline code to recombine the lines so that a single event contains the entire JSON object. There is an example of that [here](https://discuss.elastic.co/t/how-to-parse-the-multiline-and-nested-json-file/297542/2).
---
### Author:  [@dashelastic](https://discuss.elastic.co/u/dashelastic)
#### Post date: [November 25, 2025, 5:25am UTC](https://discuss.elastic.co/t/json-file-input-to-and-viewing-in-logstash-console/383608/5 "2025-11-25T05:25:57Z")
Now, with the below configuration in input.conf, errors ::
"tags" =\> [[0] "\_jsonparsefailure", [1] "\_split\_type\_failure" ]….
[logstash.filters.split][main][488f998136b23c7ca8597dc5b5359e271d93ae07ad15217c7514cafaf6ceccf4] Only String and Array types are splittable. field:[@metadata][label] is of type = NilClass
Introduced if [“message“] drop{} in the filter but this also didn’t help and if positioned at begnning, didn’t publish anything in logstash console as would be dropping the whole json.
# JSON input file remains same, as shared in earlier posts.
**input.conf**
```auto
input {
file {
path => ["/savedqueries001.json"]
codec => multiline {
pattern => "^Spalanzani"
negate => true
what => "previous"
auto_flush_interval => 1
multiline_tag => ""
}
start_position => "beginning"
sincedb_path => "NUL"
}
}
filter {
json { source => "message" target => "[@metadata][json]" remove_field => ["message"] }
ruby {
code => '
json = event.remove("[@metadata][json]")
if json.is_a? Hash
newJson =
json.each { |k, v|
newJson << v.merge({ "label" => k })
}
event.set("[@metadata][label]", newJson)
end
'
}
split { field => "[@metadata][label]" }
ruby {
code => '
d = event.remove("[@metadata][label]")
if d.is_a? Hash
d.each { |k, v|
event.set(k, v)
}
end
'
}
}
output {
stdout {}
elasticsearch {
hosts => ["http://localhost:9200"]
data_stream => "false"
index => "demo-index001"
}
}
```
> **logstash console output**
>
> `[2025-11-25T10:36:31,064][INFO][logstash.outputs.elasticsearch][main] Elasticsearch version determined (8.17.2) {:es_version=>8}`
> `[2025-11-25T10:36:31,083][INFO][logstash.outputs.elasticsearch][main] Using a default mapping template {:es_version=>8, :ecs_compatibility=>:v8}`
> `[2025-11-25T10:36:31,099][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>1000, "pipeline.sources"=>["/logstash-8.17.2/input.conf"], :thread=>"#"}`
> `[2025-11-25T10:36:32,364][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=>1.26}`
> `[2025-11-25T10:36:32,389][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=>"main"}`
> `[2025-11-25T10:36:32,391][INFO][filewatch.observingtail][main][71a930d51b7b11ba0aaf7a74cea367194e20a9ae217ce78ab759286d06c738e4] START, creating Discoverer, Watch with file and sincedb collections`
> `[2025-11-25T10:36:32,465][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>``}`
> `[2025-11-25T10:36:34,161][WARN][logstash.filters.json][main][21fb094d5f4848b0e04049621f00b2b0ccb0418890ad953f7c54e4b61f1cf1d3] Error parsing json {:source=>"message", :raw=>"{\r\n "items": [\r\n {\r\n "id": "4kjba",\r\n "description": "osquery run",\r\n "displayName": "osquery",\r\n "compartmentId": "owsda",\r\n "timeCreated": "2025-10-23T12:48:31.397Z",\r\n "timeUpdated": "2025-10-23T12:48:31.397Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": "NA",\r\n "lifecycleDetails": "NA",\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "mancom",\r\n "CreatedOn": "2025-10-23T12:48:31.252Z"\r\n }\r\n },\r\n "systemTags": {}\r\n },\r\n {\r\n "id": "ibyvq",\r\n "description": "memory",\r\n "displayName": "Memory Usage",\r\n "query": "SELECT * FROM table;",\r\n "compartmentId": "piwca",\r\n "timeCreated": "2024-08-03T10:08:54.555Z",\r\n "timeUpdated": "2024-08-03T10:08:54.555Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": "NA",\r\n "lifecycleDetails": "NA",\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "gun",\r\n "CreatedOn": "2024-08-03T10:08:54.467Z"\r\n }\r\n },\r\n "systemTags": {}\r\n },\r\n {\r\n "id": "tmjaqma",\r\n "description": "sockers",\r\n "displayName": "Process Open Sockets",\r\n "compartmentId": "iwca",\r\n "timeCreated": "2024-08-03T09:59:35.843Z",\r\n "timeUpdated": "2024-08-03T09:59:35.843Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": "NA",\r\n "lifecycleDetails": "NA",\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "pra-com",\r\n "CreatedOn": "2024-08-03T09:59:35.568Z"\r\n }\r\n },\r\n "systemTags": {}\r\n }\r\n],\r\n "locks": "NA"\r", :exception=># `at [Source: REDACTED (StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION disabled); line: 63, column: 1]>}`
> `[2025-11-25T10:36:34,163][WARN][logstash.filters.split][main][488f998136b23c7ca8597dc5b5359e271d93ae07ad15217c7514cafaf6ceccf4] Only String and Array types are splittable. field:[@metadata][label] is of type = NilClass`
> `{`
> `"@version" => "1",`
> `"host" => {`
> `"name" => "KJ"`
> `},`
> `"tags" => [`
> `[0] "_jsonparsefailure",`
> `[1] "_split_type_failure"`
> `],`
> `"@timestamp" => 2025-11-25T05:06:34.040339Z,`
> `"message" => "{\r\n "items": [\r\n {\r\n "id": "4kjba",\r\n "description": "osquery run",\r\n "displayName": "osquery",\r\n "compartmentId": "owsda",\r\n "timeCreated": "2025-10-23T12:48:31.397Z",\r\n "timeUpdated": "2025-10-23T12:48:31.397Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": "NA",\r\n "lifecycleDetails": "NA",\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "mancom",\r\n "CreatedOn": "2025-10-23T12:48:31.252Z"\r\n }\r\n },\r\n "systemTags": {}\r\n },\r\n {\r\n "id": "ibyvq",\r\n "description": "memory",\r\n "displayName": "Memory Usage",\r\n "query": "SELECT * FROM table;",\r\n "compartmentId": "piwca",\r\n "timeCreated": "2024-08-03T10:08:54.555Z",\r\n "timeUpdated": "2024-08-03T10:08:54.555Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": "NA",\r\n "lifecycleDetails": "NA",\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "gun",\r\n "CreatedOn": "2024-08-03T10:08:54.467Z"\r\n }\r\n },\r\n "systemTags": {}\r\n },\r\n {\r\n "id": "tmjaqma",\r\n "description": "sockers",\r\n "displayName": "Process Open Sockets",\r\n "compartmentId": "iwca",\r\n "timeCreated": "2024-08-03T09:59:35.843Z",\r\n "timeUpdated": "2024-08-03T09:59:35.843Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": "NA",\r\n "lifecycleDetails": "NA",\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "pra-com",\r\n "CreatedOn": "2024-08-03T09:59:35.568Z"\r\n }\r\n },\r\n "systemTags": {}\r\n }\r\n],\r\n "locks": "NA"\r",`
> `"log" => {`
> `"file" => {`
> `"path" => "/jsonFiles/savedqueries001.json"`
> `}`
> `},`
> `"event" => {`
> `"original" => "{\r\n "items": [\r\n {\r\n "id": "4kjba",\r\n "description": "osquery run",\r\n "displayName": "osquery",\r\n "compartmentId": "owsda",\r\n "timeCreated": "2025-10-23T12:48:31.397Z",\r\n "timeUpdated": "2025-10-23T12:48:31.397Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": "NA",\r\n "lifecycleDetails": "NA",\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "mancom",\r\n "CreatedOn": "2025-10-23T12:48:31.252Z"\r\n }\r\n },\r\n "systemTags": {}\r\n },\r\n {\r\n "id": "ibyvq",\r\n "description": "memory",\r\n "displayName": "Memory Usage",\r\n "query": "SELECT * FROM table;",\r\n "compartmentId": "piwca",\r\n "timeCreated": "2024-08-03T10:08:54.555Z",\r\n "timeUpdated": "2024-08-03T10:08:54.555Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": "NA",\r\n "lifecycleDetails": "NA",\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "gun",\r\n "CreatedOn": "2024-08-03T10:08:54.467Z"\r\n }\r\n },\r\n "systemTags": {}\r\n },\r\n {\r\n "id": "tmjaqma",\r\n "description": "sockers",\r\n "displayName": "Process Open Sockets",\r\n "compartmentId": "iwca",\r\n "timeCreated": "2024-08-03T09:59:35.843Z",\r\n "timeUpdated": "2024-08-03T09:59:35.843Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": "NA",\r\n "lifecycleDetails": "NA",\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "pra-com",\r\n "CreatedOn": "2024-08-03T09:59:35.568Z"\r\n }\r\n },\r\n "systemTags": {}\r\n }\r\n],\r\n "locks": "NA"\r"`
> `}`
> `}`
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 25, 2025, 4:03pm UTC](https://discuss.elastic.co/t/json-file-input-to-and-viewing-in-logstash-console/383608/6 "2025-11-25T16:03:29Z")
> [@dashelastic](#):
>
> :exception=\>#\
### Author:  [@dashelastic](https://discuss.elastic.co/u/dashelastic)
#### Post date: [November 26, 2025, 4:29am UTC](https://discuss.elastic.co/t/json-file-input-to-and-viewing-in-logstash-console/383608/7 "2025-11-26T04:29:06Z")
**Here is the json file**
================
{
"items": [
{
"id": "4kjba",
"description": "osquery run",
"displayName": "osquery",
"query": "SELECT \* from usr;",
"compartmentId": "owsda",
"timeCreated": "2025-10-23T12:48:31.397Z",
"timeUpdated": "2025-10-23T12:48:31.397Z",
"lifecycleState": "ACTIVE",
"locks": null,
"lifecycleDetails": null,
"freeformTags": {},
"definedTags": {
"Oracle-Tags": {
"CreatedBy": "ocom",
"CreatedOn": "2025-10-23T12:48:31.252Z"
}
},
"systemTags": {}
},
{
"id": "3gibyvq",
"description": null,
"displayName": "Memory Usage",
"query": "SELECT \* FROM processes;",
"compartmentId": "qpiwca",
"timeCreated": "2024-08-03T10:08:54.555Z",
"timeUpdated": "2024-08-03T10:08:54.555Z",
"lifecycleState": "ACTIVE",
"locks": null,
"lifecycleDetails": null,
"freeformTags": {},
"definedTags": {
"Oracle-Tags": {
"CreatedBy": "[oguna.com](http://oguna.com)",
"CreatedOn": "2024-08-03T10:08:54.467Z"
}
},
"systemTags": {}
},
{
"id": "yotmjaqma",
"description": null,
"displayName": "Process Open Sockets",
"query": "SELECT \* FROM process;",
"compartmentId": "qpiwca",
"timeCreated": "2024-08-03T09:59:35.843Z",
"timeUpdated": "2024-08-03T09:59:35.843Z",
"lifecycleState": "ACTIVE",
"locks": null,
"lifecycleDetails": null,
"freeformTags": {},
"definedTags": {
"Oracle-Tags": {
"CreatedBy": "[oe.com](http://oe.com)",
"CreatedOn": "2024-08-03T09:59:35.568Z"
}
},
"systemTags": {}
}
],
"locks": null
}
\*\*output in logstash console
\*\*
[2025-11-26T09:45:43,424][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>8, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>1000, "pipeline.sources"=\>["/logstash-8.17.2/input.conf"], :thread=\>"#\"}
[2025-11-26T09:45:44,581][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=\>1.16}
[2025-11-26T09:45:44,606][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=\>"main"}
[2025-11-26T09:45:44,610][INFO][filewatch.observingtail][main][142d5f829d44fcf0456de8636d8f35f7cd17a6a6fec95fd588ad2fc5d71bb90c] START, creating Discoverer, Watch with file and sincedb collections
[2025-11-26T09:45:44,659][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}
[2025-11-26T09:45:46,329][WARN][logstash.filters.json][main][c16837c1ba2cf17489a7081543cf231bf754e3a38dcb808a0afa866aaf02738c] Error parsing json {:source=\>"message", :raw=\>"{\r\n "items": [\r\n {\r\n "id": "4kjba",\r\n "description": "osquery run",\r\n "displayName": "osquery",\r\n "query": "SELECT \* from usr;",\r\n "compartmentId": "owsda",\r\n "timeCreated": "2025-10-23T12:48:31.397Z",\r\n "timeUpdated": "2025-10-23T12:48:31.397Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": null,\r\n "lifecycleDetails": null,\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "ocom",\r\n "CreatedOn": "2025-10-23T12:48:31.252Z"\r\n }\r\n },\r\n "systemTags": {}\r\n },\r\n {\r\n "id": "3gibyvq",\r\n "description": null,\r\n "displayName": "Memory Usage",\r\n "query": "SELECT \* FROM processes;",\r\n "compartmentId": "qpiwca",\r\n "timeCreated": "2024-08-03T10:08:54.555Z",\r\n "timeUpdated": "2024-08-03T10:08:54.555Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": null,\r\n "lifecycleDetails": null,\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "[oguna.com](http://oguna.com)",\r\n "CreatedOn": "2024-08-03T10:08:54.467Z"\r\n }\r\n },\r\n "systemTags": {}\r\n },\r\n {\r\n "id": "yotmjaqma",\r\n "description": null,\r\n "displayName": "Process Open Sockets",\r\n "query": "SELECT \* FROM process;",\r\n "compartmentId": "qpiwca",\r\n "timeCreated": "2024-08-03T09:59:35.843Z",\r\n "timeUpdated": "2024-08-03T09:59:35.843Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": null,\r\n "lifecycleDetails": null,\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "[oe.com](http://oe.com)",\r\n "CreatedOn": "2024-08-03T09:59:35.568Z"\r\n }\r\n },\r\n "systemTags": {}\r\n }\r\n ],\r\n "locks": null\r", :exception=\>#\}
[2025-11-26T09:45:46,330][WARN][logstash.filters.split][main][7e210c23f671f4cceea857acd2ab0ed4c8315cb6cf47fd1379481cc486cfb229] Only String and Array types are splittable. field:[@metadata][label] is of type = NilClass
{
"@timestamp" =\> 2025-11-26T04:15:46.208207600Z,
"@version" =\> "1",
"host" =\> {
"name" =\> "usr-J"
},
"log" =\> {
"file" =\> {
"path" =\> "/newFile.json"
}
},
"tags" =\> [
[0] "\_jsonparsefailure",
[1] "\_split\_type\_failure"
],
"event" =\> {
"original" =\> "{\r\n "items": [\r\n {\r\n "id": "4kjba",\r\n "description": "osquery run",\r\n "displayName": "osquery",\r\n "query": "SELECT \* from usr;",\r\n "compartmentId": "owsda",\r\n "timeCreated": "2025-10-23T12:48:31.397Z",\r\n "timeUpdated": "2025-10-23T12:48:31.397Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": null,\r\n "lifecycleDetails": null,\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "ocom",\r\n "CreatedOn": "2025-10-23T12:48:31.252Z"\r\n }\r\n },\r\n "systemTags": {}\r\n },\r\n {\r\n "id": "3gibyvq",\r\n "description": null,\r\n "displayName": "Memory Usage",\r\n "query": "SELECT \* FROM processes;",\r\n "compartmentId": "qpiwca",\r\n "timeCreated": "2024-08-03T10:08:54.555Z",\r\n "timeUpdated": "2024-08-03T10:08:54.555Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": null,\r\n "lifecycleDetails": null,\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "[oguna.com](http://oguna.com)",\r\n "CreatedOn": "2024-08-03T10:08:54.467Z"\r\n }\r\n },\r\n "systemTags": {}\r\n },\r\n {\r\n "id": "yotmjaqma",\r\n "description": null,\r\n "displayName": "Process Open Sockets",\r\n "query": "SELECT \* FROM process;",\r\n "compartmentId": "qpiwca",\r\n "timeCreated": "2024-08-03T09:59:35.843Z",\r\n "timeUpdated": "2024-08-03T09:59:35.843Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": null,\r\n "lifecycleDetails": null,\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "[oe.com](http://oe.com)",\r\n "CreatedOn": "2024-08-03T09:59:35.568Z"\r\n }\r\n },\r\n "systemTags": {}\r\n }\r\n ],\r\n "locks": null\r"
},
"message" =\> "{\r\n "items": [\r\n {\r\n "id": "4kjba",\r\n "description": "osquery run",\r\n "displayName": "osquery",\r\n "query": "SELECT \* from usr;",\r\n "compartmentId": "owsda",\r\n "timeCreated": "2025-10-23T12:48:31.397Z",\r\n "timeUpdated": "2025-10-23T12:48:31.397Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": null,\r\n "lifecycleDetails": null,\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "ocom",\r\n "CreatedOn": "2025-10-23T12:48:31.252Z"\r\n }\r\n },\r\n "systemTags": {}\r\n },\r\n {\r\n "id": "3gibyvq",\r\n "description": null,\r\n "displayName": "Memory Usage",\r\n "query": "SELECT \* FROM processes;",\r\n "compartmentId": "qpiwca",\r\n "timeCreated": "2024-08-03T10:08:54.555Z",\r\n "timeUpdated": "2024-08-03T10:08:54.555Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": null,\r\n "lifecycleDetails": null,\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "[oguna.com](http://oguna.com)",\r\n "CreatedOn": "2024-08-03T10:08:54.467Z"\r\n }\r\n },\r\n "systemTags": {}\r\n },\r\n {\r\n "id": "yotmjaqma",\r\n "description": null,\r\n "displayName": "Process Open Sockets",\r\n "query": "SELECT \* FROM process;",\r\n "compartmentId": "qpiwca",\r\n "timeCreated": "2024-08-03T09:59:35.843Z",\r\n "timeUpdated": "2024-08-03T09:59:35.843Z",\r\n "lifecycleState": "ACTIVE",\r\n "locks": null,\r\n "lifecycleDetails": null,\r\n "freeformTags": {},\r\n "definedTags": {\r\n "Oracle-Tags": {\r\n "CreatedBy": "[oe.com](http://oe.com)",\r\n "CreatedOn": "2024-08-03T09:59:35.568Z"\r\n }\r\n },\r\n "systemTags": {}\r\n }\r\n ],\r\n "locks": null\r"
}
---
### Author:  [@dashelastic](https://discuss.elastic.co/u/dashelastic)
#### Post date: [November 27, 2025, 5:33am UTC](https://discuss.elastic.co/t/json-file-input-to-and-viewing-in-logstash-console/383608/8 "2025-11-27T05:33:08Z")
The json file is the output from the REST API and used as it is, validated json file on [jsonformatter.org](http://jsonformatter.org) too.