# Log contains normal text and JSON

**URL:** <https://discuss.elastic.co/t/log-contains-normal-text-and-json/124293>\
**Category:** Logstash\
**Created:** [March 16, 2018, 12:40pm UTC](https://discuss.elastic.co/t/log-contains-normal-text-and-json/124293 "2018-03-16T12:40:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jof300](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jof300](https://discuss.elastic.co/u/jof300)\
**Post date:** [March 16, 2018, 12:40pm UTC](https://discuss.elastic.co/t/log-contains-normal-text-and-json/124293/1 "2018-03-16T12:40:18Z")

</div>

Hello,

We have some application logs which contains one part in normal text and sometimes (when ERROR) one part in JSON format. Here is an exemple :

```
2018-03-15 17:48:21.087 ERROR com.example.heraclesservice.account.AccountServiceImpl#forcePush : [] status 400 reading ContactFeignClient#create(Contact); content:
[{"message":"blablalbla.","errorCode":"DUPLICATES_DETECTED","fields":[]}]

```

I created a logstash grok filter :

grok {  
patterns\_dir =\> "./patterns/"  
match =\> { "message" =\> "%{HERACLES}" }  
}

and the pattern I have created :

```
ARGUMENTS \[.*\]
HERACLES %{TIMESTAMP_ISO8601:timestamp} \s?%{LOGLEVEL:loglevel} %{JAVACLASS:javaclass}#%{JAVAMETHOD:javamethod} : %{ARGUMENTS:args} %{GREEDYDATA:transaction_msg}

```

Everything is parsed correctly except the JSON part. I see this in Kibana :

transaction\_msg status 400 reading ContactFeignClient#create(Contact); content:

The JSON part is not taken, it's truncated..

I thought GREEDYDATA would take it.... Any idea how to resolve this ?

Thanks.

Regards

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [March 16, 2018, 12:59pm UTC](https://discuss.elastic.co/t/log-contains-normal-text-and-json/124293/2 "2018-03-16T12:59:14Z")

</div>

Is your log message multiline?  
Your example message points to that, and the GREEDYDATA part grabs everything up to where the newline character seems to be if that's the case,

---

<div class="post-metadata">

**Author:** ![jof300](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jof300](https://discuss.elastic.co/u/jof300)\
**Post date:** [March 16, 2018, 1:18pm UTC](https://discuss.elastic.co/t/log-contains-normal-text-and-json/124293/3 "2018-03-16T13:18:25Z")

</div>

Hello,

No, the message is in one line.

Regards

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 16, 2018, 6:59pm UTC](https://discuss.elastic.co/t/log-contains-normal-text-and-json/124293/4 "2018-03-16T18:59:35Z")

</div>

> No, the message is in one line.

The example you posted sure has a newline character in it and it would explain the behavior you're seeing perfectly.

---

<div class="post-metadata">

**Author:** ![jof300](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jof300](https://discuss.elastic.co/u/jof300)\
**Post date:** [March 20, 2018, 8:09am UTC](https://discuss.elastic.co/t/log-contains-normal-text-and-json/124293/5 "2018-03-20T08:09:46Z")

</div>

Yes, it seems you are right.

When I open the log in notepad, the log is one line. On a Linux, in two lines as you said.

I'll check why .

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2018, 8:09am UTC](https://discuss.elastic.co/t/log-contains-normal-text-and-json/124293/6 "2018-04-17T08:09:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.