# Json\_lines codec is not able to parse certain jsons correctly

**URL:** https://discuss.elastic.co/t/json-lines-codec-is-not-able-to-parse-certain-jsons-correctly/241593
**Category:** Logstash
**Created:** [July 17, 2020, 7:21am UTC](https://discuss.elastic.co/t/json-lines-codec-is-not-able-to-parse-certain-jsons-correctly/241593 "2020-07-17T07:21:38Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![buch11](https://avatars.discourse-cdn.com/v4/letter/b/9de0a6/32.png) [@buch11](https://discuss.elastic.co/u/buch11)
#### Post date: [July 17, 2020, 7:21am UTC](https://discuss.elastic.co/t/json-lines-codec-is-not-able-to-parse-certain-jsons-correctly/241593/1 "2020-07-17T07:21:38Z")

</div>

I am using json\_lines codec along with http\_input in my pipeline. One of the elements in my JSON is querystring. Usually, this codec is able to handle all the variants of valid jsons except below

```auto
   "querystring": {
      "a": true,
      "p[]": [
        "q",
        "l"
      ],
      "z": "x"
    }

```

When I use this event, logstash writes one line on log saying:

```
[2020-07-17T07:17:10,052][WARN][logstash.codecs.jsonlines] JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Invalid FieldReference: `p[]`>, :data=>"

```

When I tried using same json without '' after letter 'p', the codec is able to parse it correctly. So below json, works fine :

```auto
   "querystring": {
      "a": true,
      "p": [
        "q",
        "l"
      ],
      "z": "x"
    }

```

Does anyone know how to fix this behaviour or the root cause of this?

---

<div class="post-metadata">

### Author: ![buch11](https://avatars.discourse-cdn.com/v4/letter/b/9de0a6/32.png) [@buch11](https://discuss.elastic.co/u/buch11)
#### Post date: [July 17, 2020, 7:27am UTC](https://discuss.elastic.co/t/json-lines-codec-is-not-able-to-parse-certain-jsons-correctly/241593/2 "2020-07-17T07:27:48Z")

</div>

I have parsed both jsons with plain ruby and jackson( which Logstash's jruby also uses) without any issues!

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 17, 2020, 4:08pm UTC](https://discuss.elastic.co/t/json-lines-codec-is-not-able-to-parse-certain-jsons-correctly/241593/3 "2020-07-17T16:08:37Z")

</div>

> [@buch11](#):
>
> Does anyone know how to fix this behaviour or the root cause of this?

Yes, it is a [known issue](https://github.com/logstash-plugins/logstash-filter-json/issues/38). The JSON is parsed OK, but when time comes to event.set the key it is treated as a field reference, which breaks. I believe you can work around this by using a json filter instead of a codec and setting the target option, or else by using mutate+gsub to strip the square brackets out.

---

<div class="post-metadata">

### Author: ![buch11](https://avatars.discourse-cdn.com/v4/letter/b/9de0a6/32.png) [@buch11](https://discuss.elastic.co/u/buch11)
#### Post date: [July 21, 2020, 3:56am UTC](https://discuss.elastic.co/t/json-lines-codec-is-not-able-to-parse-certain-jsons-correctly/241593/4 "2020-07-21T03:56:51Z")

</div>

Thanks Badger!

The thing is, we are using json\_lines codec along with http\_input plugin, which is the first the thing running in pipeline. so unfortunately, we cant use mutate+gsub. Having said this, we tried using json filter but it cant handle mutiple jsons separated by new lines.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 18, 2020, 3:57am UTC](https://discuss.elastic.co/t/json-lines-codec-is-not-able-to-parse-certain-jsons-correctly/241593/5 "2020-08-18T03:57:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.