Json filer error

Elastic Stack Logstash
1

in kibana

message:`{"dataType":"System.String","host":"xx-PC","name":"TextualDataItem","3dd":"xx.xx.2","time":"2018/4/20 1:34:37","value":"EJbQ7>ID%l"/2j<?^\Y(eAw{j6T V2lad@hwf.W'@YR5"}`
tags	 :	_jsonparsefailure

filter is

filter 
{
  json {
    source => "message"
    id => "json_train"
  }

the value is like: "value":"EJbQ7>ID%l"/2j<?^\Y(eAw{j6T V2lad@hwf.W'@YR5"}
why fail? json can't analysis "value"
how i can do about this?
thanks so much
by andy zhou

2

Can you post your json file ? And how to you push json file to Logstash? Use filebeat or something else?

3

use udp dat into logstash. data format is json..

4

Your json data contain some special character like " . It make wrong json format. So that why _jsonparsefailure

You can check and validate your json data in https://jsonformatter.org/ for more detail

5

i wan't storage in es like this:
"value": "EJbQ7>ID%l"/2j<?^\Y(eAw{j6T V2lad@hwf.W'@YR5"
not analysis the value how configure?

6

But to do that, you need a parsable message. If you can not change the source, you could try to escape the quotes that belong to the value with a gsub filter like
(?<=[^{,:])"(?=[^,:}])
But that breaks, if you have something like "} within the field. I can't think of an easy way to save that string. It would really be best, if you didn't feed logstash with an invalid format in the first place.

Edit: (?<!^{|":|",)"(?!,"|:"|}$) would probably work for every except "," or ":". So if these character combinations do not occur in your values, you could escape your desired backslashes first and then the quotes and then use a json filter ... Not a pretty solution.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.