Json parse exception on \r in logstash 5.2. for nested json on windows

Elastic Stack Logstash
1

Hi All,

I have a nested json as a file input as below:

[
  {
  "status": "OK", 
  "total":2, 
  "doc_value": {
    "state": "1", 
    "value": "0.203222", 
    "type": "new"
  }, 
  "language": "english", 
  "doc_state": { 
    "state": "0.051384", 
    "data": "0.1089"
  }, 
  "uname": "abxdch"
},
{
  "status": "OK", 
"total": "2", 
  "doc_value": {
    "state": "989", 
    "value": "0.898222", 
    "type": "updated"
  }, 
  "language": "german", 
  "doc_state": { 
    "state": "0.051384", 
    "data": "0.1089"
  }, 
  "uname": "yhtgfr"
}]

Now, I am importing this .json file to ES with logstash:

my conf is:


  input 
{   
    file 
    {  
       path => "filepath.json"
       start_position => beginning
        "sincedb_path" => "/dev/null"
		"ignore_older" => 0
    }
}



filter {
json {

 source => "message"

}


}


output { 
stdout { codec => "rubydebug" }
 elasticsearch {
  hosts => "host:port"
  index => "index_name"
  
  } }

I understand I am missing out something really basic.

any pointers please

Best,
Divya

2

Logstash reads a file line by line. If you have a file with a multiline JSON structure you need to use a multiline codec to join the lines into the same event. Perhaps you can use the closing square bracket as an end-of-event indicator?

3

Hi Magnus,

Appreciate your help... Thanks

I tried multiline codec in input

input 
{   
    file 
    {  
       path => "path to file"
       start_position => beginning
        "sincedb_path" => "/dev/null"
		"ignore_older" => 0
		
		 codec => multiline {
          pattern => "\]$"
		what => "next"
  }
}
        }

but still no avail... I still get the exception of json_parse_failure.

Please let me know what should be updated.

Thanks in advance
-Best,

4

Try this multiline codec instead:

multiline {
  pattern => "\]$"
  negate => true
  what => "next"
}

That is, until you find a closing square bracket, join with the next line.

5

Hi Magnus,

Thanks for the response but it is still not working. it stuck after the logstash successfully started. :frowning:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.