_jsonparsefailure with grok in Logstash

[michielM (Michiel)]

Hi, I'm configuring a filter for my log and I am getting a _jsonparsefailure in my tag, and I have no idea what's causing this. This is the filter I'm using.

    filter {
    if "atlassian-jira-perf" in [tags] {
    grok {
     match => { "message" =>"%{TIMESTAMP_ISO8601:timestamp} (?<instrument>[^\ ]*) ?%.  {GREEDYDATA:log_message}" }
     tag_on_failure => ["no_match"]
  }
  if "no_match" not in [tags] {
    json {
      source => "log_message"
    }
  }
}
}

This is the log I'm trying to parse.
2020-03-11 05:54:26,174 JMXINSTRUMENTS-Threading [{"timestamp":"1583906066","label":"Threading","ObjectName":"java.lang:type\u003dThreading","attributes":[{"name":"CurrentThreadUserTime","value":18600000000},{"name":"ThreadCount","value":152},{"name":"TotalStartedThreadCount","value":1138},{"name":"CurrentThreadCpuTime","value":20804323112},{"name":"PeakThreadCount","value":164},{"name":"DaemonThreadCount","value":136}]}]

And this is the outcome.

[ITIC (Jordi)]

Hi

We don't see it in the picture of text you posted (don't do that, copy and paste the text), is "atlassian-jira-perf" in your [tags]?

If not, log_message will not exist and your json{} filter will fail.

Hope this helps

[michielM (Michiel)]

thanks for the response,
Sorry for the bad image. atlassian-jira-perf is in the tags yes