# Json filer error

**URL:** <https://discuss.elastic.co/t/json-filer-error/128782>\
**Category:** Logstash\
**Created:** [April 20, 2018, 1:35am UTC](https://discuss.elastic.co/t/json-filer-error/128782 "2018-04-20T01:35:08Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Post date:** [April 20, 2018, 1:35am UTC](https://discuss.elastic.co/t/json-filer-error/128782/1 "2018-04-20T01:35:08Z")

</div>

in kibana

```
message:`{"dataType":"System.String","host":"xx-PC","name":"TextualDataItem","3dd":"xx.xx.2","time":"2018/4/20 1:34:37","value":"EJbQ7>ID%l"/2j<?^\Y(eAw{j6T V2lad@hwf.W'@YR5"}`
tags :	_jsonparsefailure

```

filter is

```
filter 
{
  json {
    source => "message"
    id => "json_train"
  }

```

the value is like: "value":"EJbQ7\>ID%l"/2j\<?^\Y(eAw{j6T V2lad@hwf.W'@YR5"}  
why fail? json can't analysis "value"  
how i can do about this?  
thanks so much  
by andy zhou

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [April 20, 2018, 2:47am UTC](https://discuss.elastic.co/t/json-filer-error/128782/2 "2018-04-20T02:47:35Z")

</div>

Can you post your json file ? And how to you push json file to Logstash? Use filebeat or something else?

---

<div class="post-metadata">

**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Post date:** [April 20, 2018, 3:18am UTC](https://discuss.elastic.co/t/json-filer-error/128782/3 "2018-04-20T03:18:27Z")

</div>

use udp dat into logstash. data format is json..

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [April 20, 2018, 4:29am UTC](https://discuss.elastic.co/t/json-filer-error/128782/4 "2018-04-20T04:29:21Z")

</div>

> [@zqc0512](#):
>
> {"dataType":"System.String","host":"xx-PC","name":"TextualDataItem","3dd":"xx.xx.2","time":"2018/4/20 1:34:37","value":"EJbQ7\>ID%l"/2j\<?^\Y(eAw{j6T V2lad@hwf.W'@YR5"}

Your json data contain some special character like " . It make wrong json format. So that why **\_jsonparsefailure**

You can check and validate your json data in [https://jsonformatter.org/](https://jsonformatter.org/) for more detail

---

<div class="post-metadata">

**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Post date:** [April 20, 2018, 5:05am UTC](https://discuss.elastic.co/t/json-filer-error/128782/5 "2018-04-20T05:05:01Z")

</div>

i wan't storage in es like this:  
" **value**": "**EJbQ7\>ID%l"/2j\<?^\Y(eAw{j6T V2lad@hwf.W'@YR5**"  
not analysis the value how configure?

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [April 20, 2018, 8:39am UTC](https://discuss.elastic.co/t/json-filer-error/128782/6 "2018-04-20T08:39:14Z")

</div>

But to do that, you need a parsable message. If you can not change the source, you could try to escape the quotes that belong to the value with a gsub filter like  
`(?<=[^{,:])"(?=[^,:}])`  
But that breaks, if you have something like `"}` within the field. I can't think of an easy way to save that string. It would really be best, if you didn't feed logstash with an invalid format in the first place.

* * *

Edit: `(?<!^{|":|",)"(?!,"|:"|}$)` would probably work for every except `","` or `":"`. So if these character combinations do not occur in your values, you could escape your desired backslashes first and then the quotes and then use a json filter ... Not a pretty solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2018, 8:39am UTC](https://discuss.elastic.co/t/json-filer-error/128782/7 "2018-05-18T08:39:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.