Argh - Nope 
input {
stdin {
codec => multiline {
pattern => "^Spalanzani"
# negate => true
what => "previous"
auto_flush_interval => 2
}
}
}
filter {
json { source => "message" target => "theJSON" }
}
output {
stdout { codec => rubydebug }
}
Same issue
[WARN ] 2023-09-17 22:00:05.798 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" {", :exception=>#<LogStash::Json::ParserError: Unexpected end-of-input: expected close marker for Object (start marker at [Source: (byte[])" {"; line: 1, column: 2])
at [Source: (byte[])" {"; line: 1, column: 5]>}
[WARN ] 2023-09-17 22:00:05.801 [[main]>worker3] json - Error parsing json {:source=>"message", :raw=>" },", :exception=>#<LogStash::Json::ParserError: Unexpected close marker '}': expected ']' (for root starting at [Source: (byte[])" },"; line: 1, column: 0])
at [Source: (byte[])" },"; line: 1, column: 3]>}
[WARN ] 2023-09-17 22:00:05.801 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" {", :exception=>#<LogStash::Json::ParserError: Unexpected end-of-input: expected close marker for Object (start marker at [Source: (byte[])" {"; line: 1, column: 2])
at [Source: (byte[])" {"; line: 1, column: 5]>}
[WARN ] 2023-09-17 22:00:05.802 [[main]>worker2] json - Error parsing json {:source=>"message", :raw=>" \"tenant_name\": \"exmaple\"", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "tenant_name": "exmaple""; line: 1, column: 17]>}
[WARN ] 2023-09-17 22:00:05.805 [[main]>worker3] json - Error parsing json {:source=>"message", :raw=>" \"source_port\": 44480,", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "source_port": 44480,"; line: 1, column: 17]>}
[WARN ] 2023-09-17 22:00:05.806 [[main]>worker3] json - Error parsing json {:source=>"message", :raw=>" \"http_method\": \"GET\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "http_method": "GET","; line: 1, column: 17]>}
[WARN ] 2023-09-17 22:00:05.809 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"destination_ip\": \"66.22.93.239\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "destination_ip": "66.22.93.239","; line: 1, column: 20]>}
[WARN ] 2023-09-17 22:00:05.809 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"host\": \"exmaple.com\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "host": "exmaple.com","; line: 1, column: 10]>}
[WARN ] 2023-09-17 22:00:05.811 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"request\": \"GET /images/FEBRUARY_2017/Motor-Claim-Fire-Financial-Express-20.02.17.jpg HTTP/1.1\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "request": "GET /images/FEBRUARY_2017/Motor-Claim-Fire-Financial-Express-20.02.17.jpg HTTP/1.1","; line: 1, column: 13]>}
[WARN ] 2023-09-17 22:00:05.811 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"directory\": \"/images/FEBRUARY_2017\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "directory": "/images/FEBRUARY_2017","; line: 1, column: 15]>}
[WARN ] 2023-09-17 22:00:05.812 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"user_agent\": \"Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "user_agent": "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)","; line: 1, column: 16]>}
[WARN ] 2023-09-17 22:00:05.813 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"accept_language\": \"en\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "accept_language": "en","; line: 1, column: 21]>}
[WARN ] 2023-09-17 22:00:05.813 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"x-forwarded-for\": \"-\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "x-forwarded-for": "-","; line: 1, column: 21]>}
[WARN ] 2023-09-17 22:00:05.814 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"referrer\": \"-\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "referrer": "-","; line: 1, column: 14]>}
[WARN ] 2023-09-17 22:00:05.816 [[main]>worker2] json - Error parsing json {:source=>"message", :raw=>" \"source_ip\": \"167.114.103.160\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "source_ip": "167.114.103.160","; line: 1, column: 15]>}
[WARN ] 2023-09-17 22:00:05.817 [[main]>worker2] json - Error parsing json {:source=>"message", :raw=>" \"protocol\": \"https\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "protocol": "https","; line: 1, column: 14]>}
[WARN ] 2023-09-17 22:00:05.817 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"cookie\": \"-\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "cookie": "-","; line: 1, column: 12]>}
[WARN ] 2023-09-17 22:00:05.818 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"request_time\": \"0.031\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "request_time": "0.031","; line: 1, column: 18]>}
[WARN ] 2023-09-17 22:00:05.819 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"response_code\": 301,", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "response_code": 301,"; line: 1, column: 19]>}
[WARN ] 2023-09-17 22:00:05.819 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"http_bytes_in\": 437,", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "http_bytes_in": 437,"; line: 1, column: 19]>}
[WARN ] 2023-09-17 22:00:05.820 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"http_bytes_out\": 740,", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "http_bytes_out": 740,"; line: 1, column: 20]>}
[WARN ] 2023-09-17 22:00:05.821 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"country_code\": \"CA\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "country_code": "CA","; line: 1, column: 18]>}
[WARN ] 2023-09-17 22:00:05.821 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"action\": \"Allowed\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "action": "Allowed","; line: 1, column: 12]>}
[WARN ] 2023-09-17 22:00:05.822 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"application_id\": \"4de48c5d-becc-49a3-bbf8-5fc57ff2e3c2\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "application_id": "4de48c5d-becc-49a3-bbf8-5fc57ff2e3c2","; line: 1, column: 20]>}
[WARN ] 2023-09-17 22:00:05.823 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"application_name\": \"exmaple\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "application_name": "exmaple","; line: 1, column: 22]>}
[WARN ] 2023-09-17 22:00:05.823 [[main]>worker1] json - Error parsing json {:source=>"message", :raw=>" \"tenant_name\": \"exmaple\"", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "tenant_name": "exmaple""; line: 1, column: 17]>}
[WARN ] 2023-09-17 22:00:05.825 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"time\": \"12/Aug/2023:13:20:53 +0000\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "time": "12/Aug/2023:13:20:53 +0000","; line: 1, column: 10]>}
[WARN ] 2023-09-17 22:00:05.825 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"source_ip\": \"167.114.103.160\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "source_ip": "167.114.103.160","; line: 1, column: 15]>}
[WARN ] 2023-09-17 22:00:05.826 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"source_port\": 41860,", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "source_port": 41860,"; line: 1, column: 17]>}
[WARN ] 2023-09-17 22:00:05.827 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"destination_ip\": \"66.22.93.239\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "destination_ip": "66.22.93.239","; line: 1, column: 20]>}
[WARN ] 2023-09-17 22:00:05.832 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"destination_port\": 443,", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "destination_port": 443,"; line: 1, column: 22]>}
[WARN ] 2023-09-17 22:00:05.854 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"protocol\": \"https\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "protocol": "https","; line: 1, column: 14]>}
[WARN ] 2023-09-17 22:00:05.856 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"http_method\": \"GET\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "http_method": "GET","; line: 1, column: 17]>}
[WARN ] 2023-09-17 22:00:05.857 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"host\": \"www.exmaple.com\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "host": "www.exmaple.com","; line: 1, column: 10]>}
[WARN ] 2023-09-17 22:00:05.858 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"request\": \"GET /images/FEBRUARY_2017/Money-Today-21.02.17_e-Insurance.jpg HTTP/1.1\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "request": "GET /images/FEBRUARY_2017/Money-Today-21.02.17_e-Insurance.jpg HTTP/1.1","; line: 1, column: 13]>}
[WARN ] 2023-09-17 22:00:05.858 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"directory\": \"/images/FEBRUARY_2017\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "directory": "/images/FEBRUARY_2017","; line: 1, column: 15]>}
[WARN ] 2023-09-17 22:00:05.859 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"user_agent\": \"Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "user_agent": "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)","; line: 1, column: 16]>}
[WARN ] 2023-09-17 22:00:05.885 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"accept_language\": \"en\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "accept_language": "en","; line: 1, column: 21]>}
[WARN ] 2023-09-17 22:00:05.886 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"x-forwarded-for\": \"-\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "x-forwarded-for": "-","; line: 1, column: 21]>}
[WARN ] 2023-09-17 22:00:05.887 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"referrer\": \"-\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "referrer": "-","; line: 1, column: 14]>}
[WARN ] 2023-09-17 22:00:05.892 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"cookie\": \"-\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "cookie": "-","; line: 1, column: 12]>}
[WARN ] 2023-09-17 22:00:05.895 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"request_time\": \"0.570\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "request_time": "0.570","; line: 1, column: 18]>}
[WARN ] 2023-09-17 22:00:05.897 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"response_code\": 200,", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "response_code": 200,"; line: 1, column: 19]>}
[WARN ] 2023-09-17 22:00:05.898 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"http_bytes_in\": 430,", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "http_bytes_in": 430,"; line: 1, column: 19]>}
[WARN ] 2023-09-17 22:00:05.899 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"http_bytes_out\": 4078,", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "http_bytes_out": 4078,"; line: 1, column: 20]>}
[WARN ] 2023-09-17 22:00:05.899 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"country_code\": \"CA\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "country_code": "CA","; line: 1, column: 18]>}
[WARN ] 2023-09-17 22:00:05.900 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"action\": \"Allowed\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "action": "Allowed","; line: 1, column: 12]>}
[WARN ] 2023-09-17 22:00:05.905 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"application_id\": \"4de48c5d-becc-49a3-bbf8-5fc57ff2e3c2\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "application_id": "4de48c5d-becc-49a3-bbf8-5fc57ff2e3c2","; line: 1, column: 20]>}
[WARN ] 2023-09-17 22:00:05.907 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"application_name\": \"exmaple\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "application_name": "exmaple","; line: 1, column: 22]>}
[WARN ] 2023-09-17 22:00:05.908 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"time\": \"12/Aug/2023:13:20:56 +0000\",", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "time": "12/Aug/2023:13:20:56 +0000","; line: 1, column: 10]>}
[WARN ] 2023-09-17 22:00:05.909 [[main]>worker0] json - Error parsing json {:source=>"message", :raw=>" \"destination_port\": 443,", :exception=>#<LogStash::Json::ParserError: Unexpected character (':' (code 58)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: (byte[])" "destination_port": 443,"; line: 1, column: 22]>}
{
"@timestamp" => 2023-09-17T16:30:05.432Z,
"@version" => "1",
"message" => " },",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.438Z,
"@version" => "1",
"message" => " \"source_port\": 44480,",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.442Z,
"@version" => "1",
"message" => " \"http_method\": \"GET\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.386Z,
"@version" => "1",
"message" => " {",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.420Z,
"@version" => "1",
"message" => " \"time\": \"12/Aug/2023:13:20:53 +0000\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.421Z,
"@version" => "1",
"message" => " \"source_ip\": \"167.114.103.160\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.421Z,
"@version" => "1",
"message" => " \"source_port\": 41860,",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.422Z,
"@version" => "1",
"message" => " \"destination_ip\": \"66.22.93.239\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.422Z,
"@version" => "1",
"message" => " \"destination_port\": 443,",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.422Z,
"@version" => "1",
"message" => " \"protocol\": \"https\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.422Z,
"@version" => "1",
"message" => " \"http_method\": \"GET\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.422Z,
"@version" => "1",
"message" => " \"host\": \"www.exmaple.com\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.423Z,
"@version" => "1",
"message" => " \"request\": \"GET /images/FEBRUARY_2017/Money-Today-21.02.17_e-Insurance.jpg HTTP/1.1\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.423Z,
"@version" => "1",
"message" => " \"directory\": \"/images/FEBRUARY_2017\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.423Z,
"@version" => "1",
"message" => " \"user_agent\": \"Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.423Z,
"@version" => "1",
"message" => " \"accept_language\": \"en\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.423Z,
"@version" => "1",
"message" => " \"x-forwarded-for\": \"-\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.424Z,
"@version" => "1",
"message" => " \"referrer\": \"-\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.424Z,
"@version" => "1",
"message" => " \"cookie\": \"-\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.424Z,
"@version" => "1",
"message" => " \"request_time\": \"0.570\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.424Z,
"@version" => "1",
"message" => " \"response_code\": 200,",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.424Z,
"@version" => "1",
"message" => " \"http_bytes_in\": 430,",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.425Z,
"@version" => "1",
"message" => " \"http_bytes_out\": 4078,",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.425Z,
"@version" => "1",
"message" => " \"country_code\": \"CA\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.425Z,
"@version" => "1",
"message" => " \"action\": \"Allowed\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.425Z,
"@version" => "1",
"message" => " \"application_id\": \"4de48c5d-becc-49a3-bbf8-5fc57ff2e3c2\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.426Z,
"@version" => "1",
"message" => " \"application_name\": \"exmaple\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.434Z,
"@version" => "1",
"message" => " \"time\": \"12/Aug/2023:13:20:56 +0000\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.442Z,
"@version" => "1",
"message" => " \"destination_port\": 443,",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.432Z,
"@version" => "1",
"message" => " {",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.439Z,
"@version" => "1",
"message" => " \"destination_ip\": \"66.22.93.239\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.443Z,
"@version" => "1",
"message" => " \"host\": \"exmaple.com\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.443Z,
"@version" => "1",
"message" => " \"request\": \"GET /images/FEBRUARY_2017/Motor-Claim-Fire-Financial-Express-20.02.17.jpg HTTP/1.1\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.443Z,
"@version" => "1",
"message" => " \"directory\": \"/images/FEBRUARY_2017\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.443Z,
"@version" => "1",
"message" => " \"user_agent\": \"Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.443Z,
"@version" => "1",
"message" => " \"accept_language\": \"en\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.443Z,
"@version" => "1",
"message" => " \"x-forwarded-for\": \"-\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.444Z,
"@version" => "1",
"message" => " \"referrer\": \"-\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.444Z,
"@version" => "1",
"message" => " \"cookie\": \"-\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.444Z,
"@version" => "1",
"message" => " \"request_time\": \"0.031\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.444Z,
"@version" => "1",
"message" => " \"response_code\": 301,",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.444Z,
"@version" => "1",
"message" => " \"http_bytes_in\": 437,",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.444Z,
"@version" => "1",
"message" => " \"http_bytes_out\": 740,",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.444Z,
"@version" => "1",
"message" => " \"country_code\": \"CA\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.445Z,
"@version" => "1",
"message" => " \"action\": \"Allowed\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.445Z,
"@version" => "1",
"message" => " \"application_id\": \"4de48c5d-becc-49a3-bbf8-5fc57ff2e3c2\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.445Z,
"@version" => "1",
"message" => " \"application_name\": \"exmaple\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.445Z,
"@version" => "1",
"message" => " \"tenant_name\": \"exmaple\"",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.430Z,
"@version" => "1",
"message" => " \"tenant_name\": \"exmaple\"",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.436Z,
"@version" => "1",
"message" => " \"source_ip\": \"167.114.103.160\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
{
"@timestamp" => 2023-09-17T16:30:05.442Z,
"@version" => "1",
"message" => " \"protocol\": \"https\",",
"tags" => [
[0] "_jsonparsefailure"
],
"host" => "traplox"
}
Then I thought to use split filter
filter {
json { source => "message" target => "theJSON" }
split {
field => "theJSON"
}
}
Then getting below error
[WARN ] 2023-09-17 22:05:49.143 [[main]>worker0] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.150 [[main]>worker3] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.152 [[main]>worker1] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.152 [[main]>worker1] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.152 [[main]>worker1] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.152 [[main]>worker1] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.152 [[main]>worker1] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.153 [[main]>worker1] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.153 [[main]>worker0] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.153 [[main]>worker1] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.153 [[main]>worker0] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.153 [[main]>worker2] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.153 [[main]>worker2] split - Only String and Array types are splittable. field:theJSON is of type = NilClass
[WARN ] 2023-09-17 22:05:49.154 [[main]>worker0] split - Only String and Array types are splittable. field:theJSON is of type = NilClass