Logstash config JSON parse error

Elastic Stack Logstash
1

Hi,

I am trying to parse a json file using logstash, but getting json parse error.

[WARN ][logstash.filters.json ] Error parsing json {:source=>"message", :raw=>"\t\t\t\t\t1568996833,", :exception=>#<LogStash::Json::ParserError: Unexpected character (',' (code 44)): Expected space separating root-level values
at [Source: (byte)" 1568996833,"; line: 1, column: 17]>}

My Json:
{
"info": {
"start": 1568995618,
"step": 15,
"end": 1569002818
},
"cpu": [
{
"metric": {
"name": "CcmExec.exe"
},
"values": [
[
1568995618,
"934.765625"
],
[
1568995633,
"934.78125"
]
]
},
{
"metric": {
"name": "HealthService.exe"
},
"values": [
[
1568995618,
"191.171875"
],
[
1568995633,
"191.171875"
]
]
}
],
"memory": [
{
"metric": {
"name": "CcmExec.exe"
},
"values": [
[
1568995618,
"85868544"
],
[
1568995633,
"85868544"
]
]
},
"metric": {
"name": "HealthService.exe"
},
"values": [
[
1568995618,
"26365952"
],
[
1568995633,
"26365952"
]
]
}
]
}

Logstash Config:

input {
file {
path => "G:/CPUMemory/*.json"
start_position => "beginning"
sincedb_path => "F:\ELKstack\logstash\data\plugins\inputs\file\cpumemory.txt"
}
}
filter {
json {
source => "message"
target => "parsedJson"
}
}
output {
elasticsearch {
action => "index"
codec => json
hosts => "https://127.0.0.1:9200"
index => "cpumemory"
cacert => "/ELKstack/logstash/config/certs/ca/ca.crt"
user => "logstash_writer"
password => "password"
manage_template => false
}
}

Kibana shows:
image

2

The JSON is not valid. It is missing a { preceding

"metric": { "name": "HealthService.exe" },

in the "memory" array.

3

Thanks, No more json parse error now.

But in Kibana, I can see data in not proper format. How can we format json data.
For example: I need this format from above json.

image

4

I think you would have to do something in a ruby filter, a bit like this.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.