# Logstash can not parse azure activity logs

**URL:** <https://discuss.elastic.co/t/logstash-can-not-parse-azure-activity-logs/76801>\
**Category:** Logstash\
**Created:** [February 28, 2017, 2:54pm UTC](https://discuss.elastic.co/t/logstash-can-not-parse-azure-activity-logs/76801 "2017-02-28T14:54:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![111148](https://avatars.discourse-cdn.com/v4/letter/1/eb8c5e/32.png) [@111148](https://discuss.elastic.co/u/111148)\
**Post date:** [February 28, 2017, 2:54pm UTC](https://discuss.elastic.co/t/logstash-can-not-parse-azure-activity-logs/76801/1 "2017-02-28T14:54:10Z")

</div>

Hello,  
I have faced with issue during parsing Azure activity logs (multiline json) by Logstash.  
Tried several codecs but all of them are useless. They can not parse multiline logs with coma delimiters.  
Please advise how to fix it and add custom fields from Json file to the logstash index (logstash-\*).  
Thanks.

Json files sctucture is next:

```
	{
		 "time": "2017-02-28T12:04:25.7263914Z",
		 "resourceId": "/SUBSCRIPTIONS/...../RESOURCEGROUPS/....",
		 "operationName": "MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE",
		 "category": "Delete",
		 "resultType": "Start",
		 "resultSignature": "Started.",
		 "durationMs": 0,
		 "callerIpAddress": "....",
		 "correlationId": "....",
		 "identity": {"authorization":{"scope":"....}},
		 "level": "Information",
		 "location": "global"
	}
	,
	{
		 "time": "2017-02-28T12:04:27.3201073Z",
		 "resourceId": "/SUBSCRIPTIONS/.../RESOURCEGROUPS/...",
		 "operationName": "MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE",
		 "category": "Delete",
		 "resultType": "Accept",
		 "resultSignature": "Accepted.Accepted",
		 "durationMs": 1586,
		 "callerIpAddress": "....",
		 "correlationId": "....",
		 "identity": {"authorization":{"..."}},
		 "level": "Information",
		 "location": "global",
		 "properties": {"statusCode":"Accepted","serviceRequestId":null}
	}
	,
	ens so on.

```

Kibana shows **\_jsonparsefailure** in tag field all the time.

---

<div class="post-metadata">

**Author:** ![111148](https://avatars.discourse-cdn.com/v4/letter/1/eb8c5e/32.png) [@111148](https://discuss.elastic.co/u/111148)\
**Post date:** [March 7, 2017, 4:08pm UTC](https://discuss.elastic.co/t/logstash-can-not-parse-azure-activity-logs/76801/2 "2017-03-07T16:08:16Z")

</div>

Hello,  
Found this topic. [Best way to parse json input?](https://discuss.elastic.co/t/best-way-to-parse-json-input/29809)

described there method works,

input {  
exec {  
command =\> "type c:\PT1H.json"  
codec =\> json  
interval =\> 60  
}  
}

but it reads only one entry from json and repeats this json record each time during the mentioned interval. (duplicates the same document in loop).

 ![](https://us1.discourse-cdn.com/elastic/original/3X/3/2/32446e1474e132ae7175fb0355c492a226e5c117.png)

Is there any method to read all entire json document from the begin till its end without time duplicates?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2017, 4:08pm UTC](https://discuss.elastic.co/t/logstash-can-not-parse-azure-activity-logs/76801/3 "2017-04-04T16:08:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.