# JSON Parsing Of Filtered Syslog JSON Objects Fails
**URL:** https://discuss.elastic.co/t/json-parsing-of-filtered-syslog-json-objects-fails/261959
**Category:** Logstash
**Created:** [January 22, 2021, 8:27pm UTC](https://discuss.elastic.co/t/json-parsing-of-filtered-syslog-json-objects-fails/261959 "2021-01-22T20:27:49Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@InfosecAtom](https://discuss.elastic.co/u/InfosecAtom)
#### Post date: [January 22, 2021, 8:27pm UTC](https://discuss.elastic.co/t/json-parsing-of-filtered-syslog-json-objects-fails/261959/1 "2021-01-22T20:27:49Z")
I am using the following config and seeing no output. Non-JSON object containing Syslog entries, as well as JSON object containing Syslog entries, are both being dropped. If I comment out the JSON parse then the JSON object successfully appears in the Grok'd `syslog_message` field without any issue.
What I was trying to achieve was to detect early on whether a Syslog entry actually contains a JSON object, then only attempting to JSON parse it if it indeed appears to contain an object. I wasn't trying to get super crazy with my RegEx though, as either it should contain a JSON-looking object, or not.
Any ideas what I seem to be failing to account for here?
```bash
filter {
if [type] == "samba" {
grok {
match => { "message" => "%{SYSLOGBASE}\s*%{GREEDYDATA:syslog_message}" }
}
if [syslog_message] =~ /{.*}/ {
json {
source => "syslog_message"
}
grok {
match => {
"[Authorization][localAddress]" => "%{GREEDYDATA}:%{IP:[destination][ip]}:%{INT:[destination][port]}"
}
}
grok {
match => {
"[Authorization][remoteAddress]" => "%{GREEDYDATA}:%{IP:[source][ip]}:%{INT:[source][port]}"
}
}
mutate {
rename => ["[Authorization][account]", "[user][name]" ]
}
} else {
drop { }
}
}
}
```
---
### Author:  [@InfosecAtom](https://discuss.elastic.co/u/InfosecAtom)
#### Post date: [January 29, 2021, 9:25pm UTC](https://discuss.elastic.co/t/json-parsing-of-filtered-syslog-json-objects-fails/261959/2 "2021-01-29T21:25:19Z")
I changed it up a bit to the following, but still got a similar result, with no JSON messages being parsed, and non-JSON messages having a parsing error.
```bash
filter {
if [type] == "samba" {
grok {
match => { "message" => "%{SYSLOGBASE}\s+%{JSON:json_message}" }
pattern_definitions => { "JSON" => "{.*}" }
}
json {
source => "json_message"
}
}
```
---
### Author:  [@InfosecAtom](https://discuss.elastic.co/u/InfosecAtom)
#### Post date: [January 29, 2021, 10:42pm UTC](https://discuss.elastic.co/t/json-parsing-of-filtered-syslog-json-objects-fails/261959/3 "2021-01-29T22:42:45Z")
🤦♂️
Rookie mistake.
It was parsing it, it just wasn't shipping it to my output, as my output had a conditional that was not met when the JSON parser redefined the field name I had been filtering on, to no longer match the conditional.
But for any folks who come after me, if you need to parse out JSON from a syslog entry then I can happily tell you that my Grok syntax in the post above works beautifully. 👍
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 26, 2021, 10:43pm UTC](https://discuss.elastic.co/t/json-parsing-of-filtered-syslog-json-objects-fails/261959/4 "2021-02-26T22:43:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.