_jsonparsefailure when ingesting a lot of files

Elastic Stack Logstash
1

I noticed that some of my files are not being ingested properly with the "_jsonparsefailure" tag.

When I take a look at the message it received, it is indeed receiving only part of the JSON file. I suspect that when Logstash sees a lot of new files at once, part of the JSON file gets cut off, and Logstash will parse the JSON file incorrectly.

Anyone else run into this issue?

2

What does an example file look like? What does your configuration look like?

3

@magnusbaeck

> input{
>     file{
>         path => /media/sf_folder/*json
>         codec => json
>     }
> }

I think the issue is that I am using a VM. and I am ingesting files through a Shared Folder. The issue was resolved when I ingested files that is local to the VM.