# Json filter fails on negative numbers

**URL:** <https://discuss.elastic.co/t/json-filter-fails-on-negative-numbers/307185>\
**Category:** Logstash\
**Created:** [June 14, 2022, 4:03pm UTC](https://discuss.elastic.co/t/json-filter-fails-on-negative-numbers/307185 "2022-06-14T16:03:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefanoste.ml](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefanoste.ml/32/79630_2.png) [@stefanoste.ml](https://discuss.elastic.co/u/stefanoste.ml)\
**Post date:** [June 14, 2022, 4:03pm UTC](https://discuss.elastic.co/t/json-filter-fails-on-negative-numbers/307185/1 "2022-06-14T16:03:46Z")

</div>

Hello,  
given the following input

```auto
{'Time': 1655214909, 'AAA': '[00AAA0AAA000A0]', 'Longitude': 12.368, 'Latitude': 41.9331, 'AltitudeGPS': 216.2, 'AltitudeMSL': 216.2, 'SpeedLat': -3.9, 'SpeedLon': 1.88, 'SpeedH': -6.98, 'homeLat': 41.9298, 'homeLon': 12.3709, 'BBB': '[0BBBBBBB00BB8B]'}

```

and the following config

```auto
filter {

    mutate {
        gsub => ["message", "'", '"']
    }

    json {
        source => "message"
    }

    date {
        match => ["Time", "UNIX"]
        target => "@timestamp"
    }
}

```

I receive the following parsing error message:

```auto
 Error parsing json {:source=>"message", :raw=>"[2022-06-14 15:54:57]:AAA[00AAA0AAA000A0] RF type:2, Protocol type:1, DataType:2, BBB:[0BBBBBBBBB00BB0B]", :exception=>#<LogStash::Json::ParserError: Unexpected character ('-' (code 45)): was expecting comma to separate Array entries
 at [Source: (byte[])"[2022-06-14 15:54:57]:AAA[00AAA1AAA000A0] RF type:2, Protocol type:1, DataType:2, BBB:[0BBBBBB00BB0B]"; line: 1, column: 7]>}

```

But, if no negative number is present in the input, the parsing completes successfully.

Is there any improvement on the config I can perform to deal with the "-"?  
Thank for any help you could provide,  
S.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 14, 2022, 4:16pm UTC](https://discuss.elastic.co/t/json-filter-fails-on-negative-numbers/307185/2 "2022-06-14T16:16:53Z")

</div>

> [@stefanoste.ml](#):
>
> `:raw=>"[2022-06-14 15:54:57]:AAA[00AAA0AAA000A0]...`

Your message does not contain JSON. The parser will think the [ starts an array, then accepts the 2022, but blows up when it gets to the - separating the year and month.

---

<div class="post-metadata">

**Author:** ![stefanoste.ml](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefanoste.ml/32/79630_2.png) [@stefanoste.ml](https://discuss.elastic.co/u/stefanoste.ml)\
**Post date:** [June 14, 2022, 4:45pm UTC](https://discuss.elastic.co/t/json-filter-fails-on-negative-numbers/307185/3 "2022-06-14T16:45:08Z")

</div>

Thank you for your reply.  
The input and the filter config are reported in my first post. No other manipulation is performed.  
Can you please help me understand how it comes that the input becomes `[2022-06-14 15:54:57]:AAA[00AAA0AAA000A0]...`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 14, 2022, 4:47pm UTC](https://discuss.elastic.co/t/json-filter-fails-on-negative-numbers/307185/4 "2022-06-14T16:47:17Z")

</div>

Clearly your input is not what you think it is.

---

<div class="post-metadata">

**Author:** ![stefanoste.ml](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefanoste.ml/32/79630_2.png) [@stefanoste.ml](https://discuss.elastic.co/u/stefanoste.ml)\
**Post date:** [June 14, 2022, 5:08pm UTC](https://discuss.elastic.co/t/json-filter-fails-on-negative-numbers/307185/5 "2022-06-14T17:08:43Z")

</div>

thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2022, 5:09pm UTC](https://discuss.elastic.co/t/json-filter-fails-on-negative-numbers/307185/6 "2022-07-12T17:09:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.