# Logstash and VirusTotal

**URL:** <https://discuss.elastic.co/t/logstash-and-virustotal/34720>\
**Category:** Logstash\
**Created:** [November 16, 2015, 7:04pm UTC](https://discuss.elastic.co/t/logstash-and-virustotal/34720 "2015-11-16T19:04:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sampasei](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sampasei](https://discuss.elastic.co/u/sampasei)\
**Post date:** [November 16, 2015, 7:04pm UTC](https://discuss.elastic.co/t/logstash-and-virustotal/34720/1 "2015-11-16T19:04:53Z")

</div>

Hi All,  
i've tried to use Lostash 2.0 with VirusTotal plugin

> **[coolacid/logstash-filter-virustotal](https://github.com/coolacid/logstash-filter-virustotal)**
>
> logstash-filter-virustotal - Virustotal Lookup filter for Logstash

  
without any result.  
Here my config file snippet:

```
    virustotal {
            apikey => "myapikey"
            field => [src_ip]
            lookup_type => "url"
            target => "virustotal"
    }

```

Below the error code

```
`Exception in filterworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#<JSON::ParserError: A JSON text must at least contain two octets!>'

JSON::ParserError: A JSON text must at least contain two octets!
     initialize at json/ext/Parser.java:175
            new at json/ext/Parser.java:151
          parse at /opt/logstash/vendor/bundle/jruby/1.9/gems/json-1.8.3-java/lib/json/common.rb:155
         filter at /opt/logstash/vendor/local_gems/0f94f654/logstash-filter-virustotal-0.1.1/lib/logstash/filters/virustotal.rb:53
   multi_filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/filters/base.rb:152
           each at org/jruby/RubyArray.java:1613
   multi_filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/filters/base.rb:149
    filter_func at (eval):1467
   filterworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/pipeline.rb:219
  start_filters at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/pipeline.rb:154

```

How can i avoid this error?  
Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 16, 2015, 8:11pm UTC](https://discuss.elastic.co/t/logstash-and-virustotal/34720/2 "2015-11-16T20:11:37Z")

</div>

Since this error originates in the virustotal plugin perhaps you should contact its author? Reading the plugin's source code it looks like it blindly assumes that it gets a non-empty response from the server but that doesn't seem to hold true in your case.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:22am UTC](https://discuss.elastic.co/t/logstash-and-virustotal/34720/3 "2017-07-06T05:22:40Z")

</div>