# JSON logstash plugin - loading in Elastic

**URL:** <https://discuss.elastic.co/t/json-logstash-plugin-loading-in-elastic/109606>\
**Category:** Logstash\
**Created:** [November 29, 2017, 2:10pm UTC](https://discuss.elastic.co/t/json-logstash-plugin-loading-in-elastic/109606 "2017-11-29T14:10:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![RickT](https://avatars.discourse-cdn.com/v4/letter/r/3bc359/32.png) [@RickT](https://discuss.elastic.co/u/RickT)\
**Post date:** [November 29, 2017, 2:10pm UTC](https://discuss.elastic.co/t/json-logstash-plugin-loading-in-elastic/109606/1 "2017-11-29T14:10:47Z")

</div>

Hello !  
the sun is shinning today, but....

I have a simple question about **`JSON logstash plugin`**.  
the log i want to parse is like this :  
**{"corId":"zzz01","datas":[{"Key":"TstName","Value":"GlobZAZ"},{"Key":"ActName","Value":"run"}],"eventSource":"WSMagic"}**

my logstash conf :  
filter {  
json { source =\> "message" }  
}

When i execute the logstsh process, i obtain :

--\> with output to rubydebug :  
...  
"corId" =\> "zzz01",  
"datas" =\> [  
[0] {  
"Key" =\> "TstName",  
"Value" =\> "GlobZAZ"  
},  
[1] {  
"Key" =\> "ActName",  
"Value" =\> "run"  
},  
[2] {  
"Key" =\> "ModeDeVente",  
"Value" =\> "ff"  
}  
],  
"eventSource" =\> "WSInterne",  
...

--\> with output to elasticsearch indice :  
"status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"**failed to parse [datas]",**  
"caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"unknown property [Key]"}}}}

Is it a indice's mapping mismatch ?

How could i resolve this, please ?  
Thanks a lot.

Versions used :  
Elasticsearch 2.1.1  
Logstash 2.4.1

---

<div class="post-metadata">

**Author:** ![RickT](https://avatars.discourse-cdn.com/v4/letter/r/3bc359/32.png) [@RickT](https://discuss.elastic.co/u/RickT)\
**Post date:** [December 11, 2017, 2:57pm UTC](https://discuss.elastic.co/t/json-logstash-plugin-loading-in-elastic/109606/2 "2017-12-11T14:57:08Z")

</div>

no answer at this time (12 days)  
am i alone with this ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2018, 2:57pm UTC](https://discuss.elastic.co/t/json-logstash-plugin-loading-in-elastic/109606/3 "2018-01-08T14:57:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.