Json filer error

in kibana

message:`{"dataType":"System.String","host":"xx-PC","name":"TextualDataItem","3dd":"xx.xx.2","time":"2018/4/20 1:34:37","value":"EJbQ7>ID%l"/2j<?^\Y(eAw{j6T V2lad@hwf.W'@YR5"}`
tags	 :	_jsonparsefailure

filter is

  json {
    source => "message"
    id => "json_train"

the value is like: "value":"EJbQ7>ID%l"/2j<?^\Y(eAw{j6T V2lad@hwf.W'@YR5"}
why fail? json can't analysis "value"
how i can do about this?
thanks so much
by andy zhou

Can you post your json file ? And how to you push json file to Logstash? Use filebeat or something else?

use udp dat into logstash. data format is json..

Your json data contain some special character like " . It make wrong json format. So that why _jsonparsefailure

You can check and validate your json data in https://jsonformatter.org/ for more detail

i wan't storage in es like this:
"value": "EJbQ7>ID%l"/2j<?^\Y(eAw{j6T V2lad@hwf.W'@YR5"
not analysis the value how configure?

But to do that, you need a parsable message. If you can not change the source, you could try to escape the quotes that belong to the value with a gsub filter like
But that breaks, if you have something like "} within the field. I can't think of an easy way to save that string. It would really be best, if you didn't feed logstash with an invalid format in the first place.

Edit: (?<!^{|":|",)"(?!,"|:"|}$) would probably work for every except "," or ":". So if these character combinations do not occur in your values, you could escape your desired backslashes first and then the quotes and then use a json filter ... Not a pretty solution.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.