# JSON file input to logstash not working

**URL:** <https://discuss.elastic.co/t/json-file-input-to-logstash-not-working/98651>\
**Category:** Logstash\
**Created:** [August 29, 2017, 8:36am UTC](https://discuss.elastic.co/t/json-file-input-to-logstash-not-working/98651 "2017-08-29T08:36:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dan](https://avatars.discourse-cdn.com/v4/letter/d/eada6e/32.png) [@Dan](https://discuss.elastic.co/u/Dan)\
**Post date:** [August 29, 2017, 8:36am UTC](https://discuss.elastic.co/t/json-file-input-to-logstash-not-working/98651/1 "2017-08-29T08:36:55Z")

</div>

I am using json input to logstash and my output is Elasticsearch.

Below is my input json file.

> [  
> {  
> color: "red",  
> value: "#f00"  
> },  
> {  
> color: "green",  
> value: "#0f0"  
> },  
> {  
> color: "blue",  
> value: "#00f"  
> },  
> {  
> color: "cyan",  
> value: "#0ff"  
> },  
> {  
> color: "magenta",  
> value: "#f0f"  
> },  
> {  
> color: "yellow",  
> value: "#ff0"  
> },  
> {  
> color: "black",  
> value: "#000"  
> }  
> ]

Below is my config file for logstash

> input  
> {  
> file  
> {  
> path =\> "D:/ELK5.0/logstash-5.0.0/bin/jsontest.json"  
> sincedb\_path =\> "D:/ELK5.0/logstash-5.0.0/bin/sincedb\_path.txt"  
> start\_position =\> "beginning"  
> }  
> }
> 
> filter {
> 
> }
> 
> output {  
> stdout { codec =\> json}  
> elasticsearch {  
> action =\> "index"  
> hosts =\> "127.0.0.1:9200"   
> index =\> "a1"  
> workers =\> 1  
> }  
> }

When i am using above config file i am getting output in kibana as each line of json file as one record.  
I searched in elastic support they suggested to use multine.  
I used below as my input but its not creating any index in Elasticsearch.

> input  
> {  
> file  
> {  
> codec =\> multiline  
> {  
> pattern =\> '^{'  
> negate =\> true  
> what =\> previous  
> }  
> path =\> "D:/ELK5.0/logstash-5.0.0/bin/jsontest.json"  
> sincedb\_path =\> "D:/ELK5.0/logstash-5.0.0/bin/sincedb\_path.txt"  
> start\_position =\> "beginning"  
> }  
> }

```
MY expected results is 
> color value
> red #f00
> green #0f0
> blue #00f
> cyan #0ff
> magenta #f0f
> yellow #ff0
> black #000

```

Please help me how can i get.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [September 4, 2017, 10:59am UTC](https://discuss.elastic.co/t/json-file-input-to-logstash-not-working/98651/2 "2017-09-04T10:59:09Z")

</div>

Firstly, the structure of the file you quoted is not valid JSON as encoded. It might be valid inside a javascript .js file but as a standalone pretty printed JSON array is it not. The fields of the inner objects MUST be quoted.

If you correct that and use the multiline codec, what output do you get when you use stdout + rubydebug as your output?

I suspect the first event message text will be

```auto
'[{\n"color": “red”,\n"value": “#f00”\n}'

```

As is, this will not parse as JSON because of the leading `[` without a trailing `]`, you need to remove this `[`.

All other lines except the last you need to remove the trailing `,` and for the last line the trailing `]`.

Maybe:

```auto
  mutate {
    gsub => [
      # remove all leading '[' and trailing ',' or ']'
      "message", "(?:\\A\\[|[,\\]]\\z)", ""
    ]
  }

```

then you can use the json filter.

Check with stdout + rubydebug codec to verify.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 2, 2017, 10:59am UTC](https://discuss.elastic.co/t/json-file-input-to-logstash-not-working/98651/3 "2017-10-02T10:59:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.