# Log stack freezing After starting API end point

**URL:** <https://discuss.elastic.co/t/log-stack-freezing-after-starting-api-end-point/253618>\
**Category:** Logstash\
**Created:** [October 28, 2020, 9:02pm UTC](https://discuss.elastic.co/t/log-stack-freezing-after-starting-api-end-point/253618 "2020-10-28T21:02:37Z")\
**Posts on this page:** 5\
**Page:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 4, 2020, 7:10pm UTC](https://discuss.elastic.co/t/log-stack-freezing-after-starting-api-end-point/253618/21 "2020-11-04T19:10:48Z")

</div>

The mutate+gsub is changing the value of the [message] field so that it becomes valid JSON. So it has to be done before the json filter.

---

<div class="post-metadata">

**Author:** ![Srini12](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@Srini12](https://discuss.elastic.co/u/Srini12)\
**Post date:** [November 4, 2020, 7:58pm UTC](https://discuss.elastic.co/t/log-stack-freezing-after-starting-api-end-point/253618/22 "2020-11-04T19:58:49Z")

</div>

@Badger  
Still no luck.

```
filter {
  mutate { gsub => ["message", "$", "]" ] }
  json {
    source => "message"	
	tag_on_failure => ["_jsonparsefailure"]
	target => "parsedJson"
	}
  
  split { field=> "parsedJson" }
}
```

---

<div class="post-metadata">

**Author:** ![Srini12](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@Srini12](https://discuss.elastic.co/u/Srini12)\
**Post date:** [November 10, 2020, 8:13pm UTC](https://discuss.elastic.co/t/log-stack-freezing-after-starting-api-end-point/253618/23 "2020-11-10T20:13:21Z")

</div>

Hi @Badger  
any further advise?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 10, 2020, 8:24pm UTC](https://discuss.elastic.co/t/log-stack-freezing-after-starting-api-end-point/253618/24 "2020-11-10T20:24:44Z")

</div>

What does the message field look like in elasticsearch now?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 8, 2020, 8:24pm UTC](https://discuss.elastic.co/t/log-stack-freezing-after-starting-api-end-point/253618/25 "2020-12-08T20:24:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/log-stack-freezing-after-starting-api-end-point/253618.md?page=1)