JSON parse error on valid JSON

Elastic Stack Logstash
1

Here is my logstash.conf file:

input {
	http {
		host => "127.0.0.1"
		port => 31311 
		ssl => false
	}
}

filter {
	mutate {
		split => { "[headers][request_path]" => "/"}
		add_field => { "index_id" => "%{[headers][request_path][1]}" }
	}
	
	ruby { 
		code => "event.set('request_path_length', event.get('[headers][request_path]').length)" 
	}
	
	if [request_path_length] == 3 {
		mutate {
			add_field => { "document_id" => "%{[headers][request_path][2]}" }
		}
	}
}
	
output {
	stdout {
		codec => "json"
	}
  
	if [request_path_length] == 3 {
		elasticsearch {
			hosts => "http://localhost:9200"
			index => "%{index_id}"
			document_id => "%{document_id}"
		}
	}
	else {
		elasticsearch {
			hosts => "http://localhost:9200"
			index => "%{index_id}"
		}
	}
}

Here is the command I ran in PowerShell:

PS C:\Users\Me\Downloads\curl-7.64.1-win64-mingw\bin> .\curl.exe -H "content-type:application/json" -XPUT 'http://127.0.0.1:31311/bo
ok/1' -d @"
>> {"IndexId":"Book","DocumentId":"0","Title":"EKQXAQQSZAAUKVLKVHXAB","Edition":1,"Author":{"Name":"Mark Twain","Nationality":"France"},"Pu
blisher":{"Name":"Harper Collins","HeadquartersAddress":{"Country":"Denmark","StreetName":"KRQAQIKTUTMTZ","PostalCode":"4539","State":"WOOS
ESVGWIJDZSZ"}}}
>> "@

Here is what I see in my LogStash terminal:

[2019-04-10T12:36:00,232][ERROR][logstash.codecs.json     ] JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected character ('I' (code 73)): was expecting double-quote to start field name
 at [Source: (String)"{IndexId:Book,DocumentId:0,Title:EKQXAQQSZAAUKVLKVHXAB,Edition:1,Author:{Name:Mark Twain,Nationality:France},Publisher:{Name:Harper Collins,HeadquartersAddress:{Country:Denmark,StreetName:KRQAQIKTUTMTZ,PostalCode:4539,State:WOOSESVGWIJDZSZ}}}"; line: 1, column: 3]>, :data=>"{IndexId:Book,DocumentId:0,Title:EKQXAQQSZAAUKVLKVHXAB,Edition:1,Author:{Name:Mark Twain,Nationality:France},Publisher:{Name:Harper Collins,HeadquartersAddress:{Country:Denmark,StreetName:KRQAQIKTUTMTZ,PostalCode:4539,State:WOOSESVGWIJDZSZ}}}"}
{"message":"{IndexId:Book,DocumentId:0,Title:EKQXAQQSZAAUKVLKVHXAB,Edition:1,Author:{Name:Mark Twain,Nationality:France},Publisher:{Name:Harper Collins,HeadquartersAddress:{Country:Denmark,StreetName:KRQAQIKTUTMTZ,PostalCode:4539,State:WOOSESVGWIJDZSZ}}}","document_id":"1","@version":"1","@timestamp":"2019-04-10T12:36:00.233Z","index_id":"book","request_path_length":3,"tags":["_jsonparsefailure"],"headers":{"content_type":"application/json","request_path":["","book","1"],"http_accept":"*/*","http_version":"HTTP/1.1","content_length":"242","request_method":"PUT","http_user_agent":"curl/7.64.1","http_host":"127.0.0.1:31311"},"host":"127.0.0.1"}

I am not sure why there was a JSON parse failure -- my JSON sample passes the validation test here.

How can I fix this issue?

2

Powershell strips double quotes inside a double-quoted string, so none of your field names have quotes around them, and the JSON parser trips over at the second character.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.