# Logstash config JSON parse error

**URL:** https://discuss.elastic.co/t/logstash-config-json-parse-error/201828
**Category:** Logstash
**Created:** [October 1, 2019, 2:47pm UTC](https://discuss.elastic.co/t/logstash-config-json-parse-error/201828 "2019-10-01T14:47:15Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)
#### Post date: [October 1, 2019, 2:47pm UTC](https://discuss.elastic.co/t/logstash-config-json-parse-error/201828/1 "2019-10-01T14:47:16Z")

</div>

Hi,

I am trying to parse a json file using logstash, but getting json parse error.

[WARN][logstash.filters.json] Error parsing json {:source=\>"message", :raw=\>"\t\t\t\t\t1568996833,", :exception=\>#\<LogStash::Json::ParserError: Unexpected character (',' (code 44)): Expected space separating root-level values  
at [Source: (byte)" 1568996833,"; line: 1, column: 17]\>}

My Json:  
{  
" **info**": {  
"start": 1568995618,  
"step": 15,  
"end": 1569002818  
},  
"cpu": [  
{  
"metric": {  
"name": "CcmExec.exe"  
},  
"values": [  
[  
1568995618,  
"934.765625"  
],  
[  
1568995633,  
"934.78125"  
]  
]  
},  
{  
"metric": {  
"name": "HealthService.exe"  
},  
"values": [  
[  
1568995618,  
"191.171875"  
],  
[  
1568995633,  
"191.171875"  
]  
]  
}  
],  
"memory": [  
{  
"metric": {  
"name": "CcmExec.exe"  
},  
"values": [  
[  
1568995618,  
"85868544"  
],  
[  
1568995633,  
"85868544"  
]  
]  
},  
"metric": {  
"name": "HealthService.exe"  
},  
"values": [  
[  
1568995618,  
"26365952"  
],  
[  
1568995633,  
"26365952"  
]  
]  
}  
]  
}

Logstash Config:

input {  
file {  
path =\> "G:/CPUMemory/\*.json"   
start\_position =\> "beginning"  
sincedb\_path =\> "F:\ELKstack\logstash\data\plugins\inputs\file\cpumemory.txt"  
}  
}  
filter {  
json {  
source =\> "message"  
target =\> "parsedJson"  
}  
}  
output {  
elasticsearch {  
action =\> "index"  
codec =\> json  
hosts =\> "[https://127.0.0.1:9200](https://127.0.0.1:9200)"  
index =\> "cpumemory"  
cacert =\> "/ELKstack/logstash/config/certs/ca/ca.crt"  
user =\> "logstash\_writer"  
password =\> "password"  
manage\_template =\> false  
}  
}

Kibana shows:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2aa34e068c1d3ee8f7b2b85651d13b0b465ce08f.png)

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 1, 2019, 5:12pm UTC](https://discuss.elastic.co/t/logstash-config-json-parse-error/201828/2 "2019-10-01T17:12:06Z")

</div>

The JSON is not valid. It is missing a { preceding

```
"metric": { "name": "HealthService.exe" },

```

in the "memory" array.

---

<div class="post-metadata">

### Author: ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)
#### Post date: [October 1, 2019, 5:48pm UTC](https://discuss.elastic.co/t/logstash-config-json-parse-error/201828/3 "2019-10-01T17:48:58Z")

</div>

Thanks, No more json parse error now.

But in Kibana, I can see data in not proper format. How can we format json data.  
For example: I need this format from above json.

![image](https://us1.discourse-cdn.com/elastic/original/3X/2/e/2ea27304d0fae38b88f478743f968d544d9e7f43.png)

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 1, 2019, 6:07pm UTC](https://discuss.elastic.co/t/logstash-config-json-parse-error/201828/4 "2019-10-01T18:07:22Z")

</div>

I think you would have to do something in a ruby filter, a bit like [this](https://discuss.elastic.co/t/flatten-the-json-array-into-field-in-filter-of-logstash/135750/2).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 29, 2019, 6:07pm UTC](https://discuss.elastic.co/t/logstash-config-json-parse-error/201828/5 "2019-10-29T18:07:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.