# JSON file parse error

**URL:** <https://discuss.elastic.co/t/json-file-parse-error/309869>\
**Category:** Logstash\
**Created:** [July 18, 2022, 9:42am UTC](https://discuss.elastic.co/t/json-file-parse-error/309869 "2022-07-18T09:42:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ichasco\_heytrade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ichasco_heytrade/32/108440_2.png) [@ichasco\_heytrade](https://discuss.elastic.co/u/ichasco_heytrade)\
**Post date:** [July 18, 2022, 9:42am UTC](https://discuss.elastic.co/t/json-file-parse-error/309869/1 "2022-07-18T09:42:16Z")

</div>

Hi, I am trying to parse a JSON file with this structure:

```auto
[
  {
    "plugin": "cloudtrailBucketAccessLogging",
    "category": "CloudTrail",
    "title": "CloudTrail Bucket Access Logging",
    "description": "Ensures CloudTrail logging bucket has access logging enabled to detect tampering of log files",
    "resource": "arn:aws:s3:::cloudtrail",
    "region": "eu-west-1",
    "status": "FAIL",
    "message": "Unable to locate S3 bucket, it may have been deleted",
    "compliance": "CIS1: 2.6 Ensure CloudTrail bucket access logging is enabled"
  },
  {
    "plugin": "cloudtrailToCloudwatch",
    "category": "CloudTrail",
    "title": "CloudTrail To CloudWatch",
    "description": "Ensures CloudTrail logs are being properly delivered to CloudWatch",
    "resource": "arn:aws:cloudtrail:eu-west-1:XXXXXXXX:trail/CloudTrail",
    "region": "us-east-1",
    "status": "FAIL",
    "message": "CloudTrail CloudWatch integration is not enabled",
    "compliance": "CIS1: 2.4 Ensure CloudTrail trails are integrated with CloudWatch Logs"
  }
]

```

But I am getting errors. Is there any way to parse this kind of files?

Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 18, 2022, 3:14pm UTC](https://discuss.elastic.co/t/json-file-parse-error/309869/2 "2022-07-18T15:14:54Z")

</div>

> [@ichasco\_heytrade](#):
>
> I am getting errors.

What configuration are you using to parse it and what errors are you gettting?

---

<div class="post-metadata">

**Author:** ![ichasco\_heytrade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ichasco_heytrade/32/108440_2.png) [@ichasco\_heytrade](https://discuss.elastic.co/u/ichasco_heytrade)\
**Post date:** [July 19, 2022, 8:58am UTC](https://discuss.elastic.co/t/json-file-parse-error/309869/3 "2022-07-19T08:58:44Z")

</div>

Here is my configuration.I have tried several different configuration that I have found from your answers in posts.

```auto
s3 {
          access_key_id => "${vault:devops/data/AWS/IAM/Users/Logstash#ACCESS_KEY_ID}"
          secret_access_key => "${vault:devops/data/AWS/IAM/Users/Logstash#SECRET_ACCESS_KEY}"
          bucket => "devops-vulnerabilities"
          region => "eu-west-1"
          prefix => "AWS/CloudSploit"
          codec => multiline { 
                                  pattern => "^Spalanzani"
                                  negate => true
                                  what => previous
                                  auto_flush_interval => 1
                                }
          #codec => "json"
          add_field => { "Vulnerability" => "true" }
          additional_settings => {
            force_path_style => true
            follow_redirects => false
          }
        }
....
filter {
        if [Vulnerability] == "true" {
          split { field => "someField" }
        }
      }

```

Here are the errors

```auto
:exception=>#<LogStash::Json::ParserError: Unexpected end-of-input within/between Object entries

```

Thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2022, 8:59am UTC](https://discuss.elastic.co/t/json-file-parse-error/309869/4 "2022-08-16T08:59:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.