JSON parse error, original data now in message field {:message=>"Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n at [Source: (String)

Same code worked in previous version 7 but i have updated to latest version Elasticsearch logstash and kibana 7.17 , the logstash code is not working and getting error, i have been trying this from 15 days , When i have tested previous version it worked , please help to resolve the issue

[ERROR][logstash.codecs.json     ][01359] JSON parse error, original
data now in message field {:message=>"Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n at [Source: (String)\"<html><head><title>Error</title></head><body>Internal Server Error</body></html>\"; line: 1, column: 2]", :exception=>LogStash::Json::ParserError, :data=>"<html><head><title>Error</title></head><body>Internal Server Error</body></html>"}



where i m doing wrong

input {
  http_poller {
   urls => {
    se123  => {
       method => get
        url => "https://**/sitemangr/v1/group/8976789098"
          headers => {
        "Content-Type" => "application/json"
     "Authorization" => "Bearer %{jghjklkhgewsklkjhgescvbnkltrezuikjhfdsxcjhgfv}"
      }
    }
 }
  request_timeout => 60
  schedule => { "every" => "100s"}
  codec => "json"
  metadata_target => "http_poller_metadata"
}
}

output {
    elasticsearch
         {
         user => user
         password =>password
         hosts => ["localhost:9200"]
         index => "iiiii-%{+xxxx.ww}"
         }
         stdout { codec => rubydebug }
        }

What does your [message] field look like? I suspect the http server, which you expect to be sending you JSON, is in fact sending you HTML, possibly an error message, in which case looking at the contents of the [message] field is your route to a solution.


In postman I get json result and in February I used to get the expected result with same logstash code. I am using the same code now getting the error . Does there any changes in new version , what modifications or any changes in syntax in http_poller input configuration?
Please let me know

It is a jboss server

[
    {
        "A": {},
        "B": "543a",
        "C": "Shafi",
        "groupHierarchy": [
            "Market",
            "shafi GmbH",
            "shafi_1-Business",
            "System"
        ],
        "D": [],
        "E": [],
        "F": [],
        "G": {
            "ref": "https://shafi/Manager/v1/groups/9865678909876545678a2b",
            "id": "0987654567892b"
        },
        "H": {
            "ref": "https://shafi/Manager/v1/users?groupid=9987786789865689fe56543a"
        },
        "I": null
    }
]













{
  "_index": "qes-2022.52",
  "_type": "_doc",
  "_id": "EFzyyjbAD9tX",
  "_version": 1,
  "_score": 1,
  "_ignored": [
    "http_poller_metadata.response_headers.content-security-policy.keyword",
    "http_poller_metadata.request.headers.Authorization.keyword"
  ],
  "_source": {
    "@timestamp": "2022-12-27T03:53:49.452Z",
    "message": "<html><head><title>Error</title></head><body>Internal Server Error</body></html>",
    "tags": [
      "_jsonparsefailure"
    ],
    "@version": "1",
    "http_poller_metadata": {
      "host": "shafi-4",
      "code": 500,
      "runtime_seconds": 0.46305500000000005,
      "response_message": "Internal Server Error",
      "name": "se123",

That may be the problem. Please format your post by editing it, selecting the data (not the text) and clicking on </> in the toolbar above the edit panel.

It really matters. Without the </> both HTML/XML and special characters will be consumed as markup (bold, italics, etc.). Once we know what the error message is then we may be able to help.

This code worked previously and now not working , please tell me the differences in 7.17 and ealrier version , do i need to change anything
input {
  http_poller {
   urls => {
    se12300  => {
       method => get
        url => "https://shafi.de/Manager/v1/group-associations/41bd4a570"
          headers => {
        "Content-Type" => "application/json"
     "Authorization" => "Bearer %{aaaaaaaaaaaaaaaa}"
      }
    }
    se1230000 => {
       method => get
        url => "https://shafi.de/Manager/v1/group-associations/4a1f1737336a"
          headers => {
        "Content-Type" => "application/json"
     "Authorization" => "Bearer %{aaaaaaaaaaaaaaa}"
     }
    }
    se1200399  => {
       method => get
        url => "https://shafi.de/Manager/v1/group-associations/3cac908beb3be"
          headers => {
        "Content-Type" => "application/json"
     "Authorization" => "Bearer %{aaaaaaaaaaaaaa}"
      }
    }
 }
  request_timeout => 60
  codec => "json"
  type => "Http_poller"
  schedule => { "every" => "100s"}
  metadata_target => "http_poller_metadata"
}
}
filter {
   date {
   match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss" ]
       }
mutate { remove_field => ["A","B","C","D","parent","members","groupType"]
}
}

output {
    elasticsearch
         {
         user => elastic
         password => password
         hosts => ["localhost:9200"]
         index => "we-%{+xxxx.ww}"
         }
         stdout { codec => rubydebug }
        }

OK, so that's HTML, not JSON. Look at the server logs to see what error it had.

previously it worked , now its not working with same logstash code

what is the difference in newer version 7.17 in http_poller plugin

i have used the same code earlier it worked
what should i do to work to work this code here , please help me

In postman i m getting json result, not getting what to do , no solution

from postman result i took in file and tried but getting same error result

please let me know what changes to do in my code to change as html

We have no way of knowing that. The server is getting an internal error. It probably logs an error message indicating what happened, you need to find that error message.

In Server below are the error

ERROR [io.undertow.request] (default task-224) UT005023: Exception handling request to /Manager/v1/group-associations/63d3-1e84-470e-94be-41b: java.lang.IllegalArgumentException: Illegal base64 character 25

at java.base/java.util.Base64$Decoder.decode0(Unknown Source)

The authentication token for Bearer authentication has to be base64 encoded. Apparently the token you are sending is not.

Is this bug from logstash in http_poller in 7.17

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.