# Logstash conf not working for json format **URL:** \ **Category:** Logstash\ **Created:** [June 20, 2017, 2:02pm UTC](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109 "2017-06-20T14:02:25Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![gangamstyle](https://avatars.discourse-cdn.com/v4/letter/g/9f8e36/32.png) [@gangamstyle](https://discuss.elastic.co/u/gangamstyle)\ **Post date:** [June 20, 2017, 2:02pm UTC](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109/1 "2017-06-20T14:02:26Z")
Hi Marcus, I have tried the json plugin but it is not working plz help me {"\_id":{"$oid":"592fdb630b2262682c85351d"},"Date":"20170510","url":"Loading of Page /start","Device":"Mobile","Browser":"UC Browser mobile","BrowserVersion":"UC Browser mobile 11.3","OS":"Android","OSVesrion":"Android 6.0 Marshmallow","ErrorCount":1.0,"SuccessCount":27.0,"TotalHit":28.0,"ErrorPerc":3.5714285714285716,"SuccessPerc":96.42857142857143} i have provided the sample of my json. and below is my conf file input { file { type =\> "json" path =\> "D:\QK\Jalpesh\conf\ganesh.json" codec=\> "json" } } filter{ json{ source =\> "message" } } output { elasticsearch { hosts =\> "localhost" index =\> "index99" } } It is loading default template ---
**Author:** ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Post date:** [June 20, 2017, 2:27pm UTC](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109/2 "2017-06-20T14:27:04Z")
Use a filter like this: ``` filter { json { source => "message" target => "__json" } } ``` I'm not sure that the json codec is needed in the input ( did not use it in my test ) and you should get something like:- ``` { "message" => "{\"_id\":{\"$oid\":\"592fdb630b2262682c85351d\"},\"Date\":\"20170510\",\"url\":\"Loading of Page /start\",\"Device\":\"Mobile\",\"Browser\":\"UC Browser mobile\",\"BrowserVersion\":\"UC Browser mobile 11.3\",\"OS\":\"Android\",\"OSVesrion\":\"Android 6.0 Marshmallow\",\"ErrorCount\":1.0,\"SuccessCount\":27.0,\"TotalHit\":28.0,\"ErrorPerc\":3.5714285714285716,\"SuccessPerc\":96.42857142857143}", "@version" => "1", "@timestamp" => "2017-06-20T14:23:32.300Z", "path" => "/Users/kryten/Documents/Utilities/logstash-2.3.1/source2.log", "host" => "kryten-mbp", "__json" => { "_id" => { "$oid" => "592fdb630b2262682c85351d" }, "Date" => "20170510", "url" => "Loading of Page /start", "Device" => "Mobile", "Browser" => "UC Browser mobile", "BrowserVersion" => "UC Browser mobile 11.3", "OS" => "Android", "OSVesrion" => "Android 6.0 Marshmallow", "ErrorCount" => 1.0, "SuccessCount" => 27.0, "TotalHit" => 28.0, "ErrorPerc" => 3.5714285714285716, "SuccessPerc" => 96.42857142857143 } } ``` With all your json fields under "\_\_json" ready for use. ---
**Author:** ![Olivia\_Smith](https://avatars.discourse-cdn.com/v4/letter/o/439d5e/32.png) [@Olivia\_Smith](https://discuss.elastic.co/u/Olivia_Smith)\ **Post date:** [June 20, 2017, 7:06pm UTC](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109/3 "2017-06-20T19:06:23Z")
Use [JSON Editor](https://jsonformatter.org/json-editor) for Edit, validate and Format JSON data. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 21, 2017, 7:13am UTC](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109/4 "2017-06-21T07:13:38Z")
> I have tried the json plugin but it is not working plz help me If you tell us in what way it doesn't work it'll be easier to help out. ---
**Author:** ![gangamstyle](https://avatars.discourse-cdn.com/v4/letter/g/9f8e36/32.png) [@gangamstyle](https://discuss.elastic.co/u/gangamstyle)\ **Post date:** [June 23, 2017, 2:49am UTC](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109/5 "2017-06-23T02:49:24Z")
Thank u for the reply .The problem is it is not loading the data from the file ,it is loading the default template ---
**Author:** ![gangamstyle](https://avatars.discourse-cdn.com/v4/letter/g/9f8e36/32.png) [@gangamstyle](https://discuss.elastic.co/u/gangamstyle)\ **Post date:** [June 23, 2017, 3:10am UTC](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109/6 "2017-06-23T03:10:46Z")
The file format i am having is .json while loading the data through logstash ,it doesnt throw error but loading default template and the index is not seen in the kibana. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 26, 2017, 9:15pm UTC](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109/7 "2017-06-26T21:15:00Z")
Logstash is probably tailing the input file. Please check out the documentation and previous posts to see what's said about the `sincedb_path` and `start_position` configuration options. ---
**Author:** ![gangamstyle](https://avatars.discourse-cdn.com/v4/letter/g/9f8e36/32.png) [@gangamstyle](https://discuss.elastic.co/u/gangamstyle)\ **Post date:** [June 27, 2017, 3:55am UTC](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109/8 "2017-06-27T03:55:35Z")
Hi Marcus, I have deleted the Sincedb files and also set the sincedb option to "NUL". But still it is loading the default template. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 27, 2017, 6:03am UTC](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109/9 "2017-06-27T06:03:38Z")
> I have deleted the Sincedb files and also set the sincedb option to "NUL". What about `start_position`? > But still it is loading the default template. Don't get distracted by that log message. Comment out the elasticsearch output and use a `stdout { codec => rubydebug }` output while debugging. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 25, 2017, 6:04am UTC](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109/10 "2017-07-25T06:04:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.