# Json parse exception on \\r in logstash 5.2. for nested json on windows

**URL:** <https://discuss.elastic.co/t/json-parse-exception-on-r-in-logstash-5-2-for-nested-json-on-windows/78104>\
**Category:** Logstash\
**Created:** [March 10, 2017, 7:38am UTC](https://discuss.elastic.co/t/json-parse-exception-on-r-in-logstash-5-2-for-nested-json-on-windows/78104 "2017-03-10T07:38:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Divya\_Bhardwaj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divya_bhardwaj/32/15231_2.png) [@Divya\_Bhardwaj](https://discuss.elastic.co/u/Divya_Bhardwaj)\
**Post date:** [March 10, 2017, 7:38am UTC](https://discuss.elastic.co/t/json-parse-exception-on-r-in-logstash-5-2-for-nested-json-on-windows/78104/1 "2017-03-10T07:38:11Z")

</div>

Hi All,

I have a nested json as a file input as below:

```auto
[
  {
  "status": "OK", 
  "total":2, 
  "doc_value": {
    "state": "1", 
    "value": "0.203222", 
    "type": "new"
  }, 
  "language": "english", 
  "doc_state": { 
    "state": "0.051384", 
    "data": "0.1089"
  }, 
  "uname": "abxdch"
},
{
  "status": "OK", 
"total": "2", 
  "doc_value": {
    "state": "989", 
    "value": "0.898222", 
    "type": "updated"
  }, 
  "language": "german", 
  "doc_state": { 
    "state": "0.051384", 
    "data": "0.1089"
  }, 
  "uname": "yhtgfr"
}]

```

Now, I am importing this .json file to ES with logstash:

my conf is:

```auto

  input 
{   
    file 
    {  
       path => "filepath.json"
       start_position => beginning
        "sincedb_path" => "/dev/null"
		"ignore_older" => 0
    }
}

filter {
json {

 source => "message"

}

}

output { 
stdout { codec => "rubydebug" }
 elasticsearch {
  hosts => "host:port"
  index => "index_name"
  
  } }

```

I understand I am missing out something really basic.

any pointers please

Best,  
Divya

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 10, 2017, 8:50am UTC](https://discuss.elastic.co/t/json-parse-exception-on-r-in-logstash-5-2-for-nested-json-on-windows/78104/2 "2017-03-10T08:50:23Z")

</div>

Logstash reads a file line by line. If you have a file with a multiline JSON structure you need to use a multiline codec to join the lines into the same event. Perhaps you can use the closing square bracket as an end-of-event indicator?

---

<div class="post-metadata">

**Author:** ![Divya\_Bhardwaj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divya_bhardwaj/32/15231_2.png) [@Divya\_Bhardwaj](https://discuss.elastic.co/u/Divya_Bhardwaj)\
**Post date:** [March 10, 2017, 9:14am UTC](https://discuss.elastic.co/t/json-parse-exception-on-r-in-logstash-5-2-for-nested-json-on-windows/78104/3 "2017-03-10T09:14:12Z")

</div>

Hi Magnus,

Appreciate your help... Thanks

I tried multiline codec in input

```auto
input 
{   
    file 
    {  
       path => "path to file"
       start_position => beginning
        "sincedb_path" => "/dev/null"
		"ignore_older" => 0
		
		 codec => multiline {
          pattern => "\]$"
		what => "next"
  }
}
        }
		

```

but still no avail... I still get the exception of json\_parse\_failure.

Please let me know what should be updated.

Thanks in advance  
-Best,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 10, 2017, 12:44pm UTC](https://discuss.elastic.co/t/json-parse-exception-on-r-in-logstash-5-2-for-nested-json-on-windows/78104/4 "2017-03-10T12:44:58Z")

</div>

Try this multiline codec instead:

```nohighlight
multiline {
  pattern => "\]$"
  negate => true
  what => "next"
}

```

That is, until you find a closing square bracket, join with the next line.

---

<div class="post-metadata">

**Author:** ![Divya\_Bhardwaj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divya_bhardwaj/32/15231_2.png) [@Divya\_Bhardwaj](https://discuss.elastic.co/u/Divya_Bhardwaj)\
**Post date:** [March 15, 2017, 8:14am UTC](https://discuss.elastic.co/t/json-parse-exception-on-r-in-logstash-5-2-for-nested-json-on-windows/78104/5 "2017-03-15T08:14:22Z")

</div>

Hi Magnus,

Thanks for the response but it is still not working. it stuck after the logstash successfully started. ☹

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2017, 8:14am UTC](https://discuss.elastic.co/t/json-parse-exception-on-r-in-logstash-5-2-for-nested-json-on-windows/78104/6 "2017-04-12T08:14:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.