Json parse failure on curl post data

Elastic Stack Logstash
1

I have a script that sends json via curl. My question is am I able to display data that is not parsed by json codec?

    [2019-01-25T11:10:01,403][WARN ][logstash.filters.json    ] Parsed JSON object/hash requires a target configuration option {:source=>"message", :raw=>"\r"}
[2019-01-25T11:11:01,508][WARN ][logstash.filters.json    ] Error parsing json {:source=>"message", :raw=>"Host: x.x.x.x:xxxx\r", :exception=>#<LogStash$
 at [Source: (byte[])"Host: x.x.x.x:xxxx^M"; line: 1, column: 6]>}
[2019-01-25T11:11:01,510][WARN ][logstash.filters.json    ] Error parsing json {:source=>"message", :raw=>"POST / HTTP/1.1\r", :exception=>#<LogStash::Json:$
 at [Source: (byte[])"POST / HTTP/1.1^M"; line: 1, column: 6]>}
[2019-01-25T11:11:01,510][WARN ][logstash.filters.json    ] Error parsing json {:source=>"message", :raw=>"User-Agent: curl/7.52.1\r", :exception=>#<LogStas$
 at [Source: (byte[])"User-Agent: curl/7.52.1^M"; line: 1, column: 6]>}
[2019-01-25T11:11:01,512][WARN ][logstash.filters.json    ] Error parsing json {:source=>"message", :raw=>"Accept: */*\r", :exception=>#<LogStash::Json::Par$
 at [Source: (byte[])"Accept: */*^M"; line: 1, column: 8]>}
[2019-01-25T11:11:01,513][WARN ][logstash.filters.json    ] Error parsing json {:source=>"message", :raw=>"Expect: 100-continue\r", :exception=>#<LogStash::$
 at [Source: (byte[])"Expect: 100-continue^M"; line: 1, column: 8]>}
[2019-01-25T11:11:01,513][WARN ][logstash.filters.json    ] Error parsing json {:source=>"message", :raw=>"Content-Length: 1055\r", :exception=>#<LogStash::$
 at [Source: (byte[])"Content-Length: 1055^M"; line: 1, column: 9]>}

parse
parse.JPG884×585 105 KB

Above you can see how the data is displayed in the discover and and may you see errors in logstash log.
I would like the data that attach to json in the form of a curl user agent to be displayed in the field indicated by me, or simply in the message field and preferably that they do not appear in the form of errors in the log.

I tried to use codec plain and customize filter json but unfortunately it does not bring the intended result.
Maybe someone has a similar problem and is able to lead me to a way in which I can solve this problem.

2

So you are trying to POST data into logstash using curl, and logstash is reading the request headers as data. What does the configuration of your input look like?

3 
tcp {
port => 5044
codec => json
}

and I tried that config too :

tcp {
port => 5044
codec => plain
}

filter {
     json {
           source => "message"
     }
4

If you are going to use curl to POST data to it then I think you want an http input, not a tcp input.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.