# JSON parse error

**URL:** https://discuss.elastic.co/t/json-parse-error/293512
**Category:** Logstash
**Tags:** language-clients
**Created:** [January 5, 2022, 9:27am UTC](https://discuss.elastic.co/t/json-parse-error/293512 "2022-01-05T09:27:28Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![rusty\_cole](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)
#### Post date: [January 5, 2022, 9:27am UTC](https://discuss.elastic.co/t/json-parse-error/293512/1 "2022-01-05T09:27:28Z")

</div>

Hi,  
I have the following error only for some of my json files, other files have no issue.  
I am guessing the root cause is the brackets in the json fields.  
I have seen some posts in the matter but no solution worked for me.  
Any help would be appreciated.

The error - JSON parse error, original data now in message field {:error=\>#\<LogStash::Json::ParserError: Invalid FieldReference:

Json file example -

```auto
[{"name": "system\\currentcontrolset\\services", "hive": "HKEY_LOCAL_MACHINE", "exists": "True", "values": {}}, {"name": "system\\currentcontrolset\\services\\.NET CLR Data", "hive": "HKEY_LOCAL_MACHINE", "exists": "True", "values": {}}, {"name": "system\\currentcontrolset\\services\\.NET CLR Data\\Linkage", "hive": "HKEY_LOCAL_MACHINE", "exists": "True", "values": {"Export": "['.NET CLR Data']"}}, {"name": "system\\currentcontrolset\\services\\.NET CLR Data\\Performance", "hive": "HKEY_LOCAL_MACHINE", "exists": "True", "values": {"Close": "ClosePerformanceData", "Collect": "CollectPerformanceData", "

```

My conf:

```auto
		            file
        {
            path => "C:/Evidence/Registry/**/*.json"
            start_position => "beginning"        
            sincedb_path => "nul"
			codec => "json"
			file_chunk_size => "90000000"
			delimiter => "§¶¶§"
			mode => "read"	
            type => "json"

        }
}
filter {

   if [type] == "json" {
    json {
    source => "[message]"
    remove_field => ["[message]"]
  }
}
}

```

---

<div class="post-metadata">

### Author: ![rusty\_cole](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)
#### Post date: [January 5, 2022, 12:11pm UTC](https://discuss.elastic.co/t/json-parse-error/293512/2 "2022-01-05T12:11:45Z")

</div>

The field that is causing the problems is - "m[~4~~": "1",  
If i remove it manually it works.  
Can i remove it with mutate gsub while using a json codec?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 5, 2022, 5:00pm UTC](https://discuss.elastic.co/t/json-parse-error/293512/3 "2022-01-05T17:00:24Z")

</div>

> [@rusty\_cole](#):
>
> Can i remove it with mutate gsub while using a json codec?

No, that is not possible. The codec decodes the JSON before the event is sent to the pipeline. You would have to remove the json filter, add a mutate+gsub filter and then a json filter _after_ the mutate.

---

<div class="post-metadata">

### Author: ![rusty\_cole](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)
#### Post date: [January 6, 2022, 8:00am UTC](https://discuss.elastic.co/t/json-parse-error/293512/4 "2022-01-06T08:00:22Z")

</div>

Unfortunately, for some reason the json filter does not work on my json files(it ignores them). only the json codec works.  
Thanks for your help anyway.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 3, 2022, 8:01am UTC](https://discuss.elastic.co/t/json-parse-error/293512/5 "2022-02-03T08:01:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.