### Author:  [@temp\_data](https://discuss.elastic.co/u/temp_data)
#### Post date: [September 13, 2024, 1:56pm UTC](https://discuss.elastic.co/t/logstash-configuration-parsing-error/366543/1 "2024-09-13T13:56:24Z")
Hi,
I'm new with Logstash and getting the error below, I think it's not parsing the json properly, does anyone see the problem in my Logstash config .
test1.json
```auto
[
{
"upsert": {
"reference": "https://www.abc.ca/en/events/#/details/14618",
"metadata": {
"author": [
"ABC"
],
"body_content": [
"abc content "
]
},
"content": "content of abc"
}
},
{
"upsert": {
"reference": "https://www.bbc.ca/en/events/#/details/14418",
"metadata": {
"author": [
"BBC"
],
"body_content": [
"BBC Content "
]
},
"content": "content of BBC"
}
}
]
```
logstash.conf
```auto
input {
file {
path => "/datadrive/json/test1.json"
start_position => "beginning"
sincedb_path => "/dev/null"
codec => multiline {
pattern => "^\{"
negate => "true"
what => "previous"
auto_flush_interval => 1
}
}
}
filter {
json {
source => "message"
}
mutate {
rename => {
"[upsert][reference]" => "reference"
"[upsert][metadata][author]" => "author"
"[upsert][metadata][body_content]" => "body_content"
"[upsert][content]" => "content"
}
}
}
output {
stdout {
codec => rubydebug
}
}
```
Error
```auto
[2024-07-13T09:35:27,033][WARN][logstash.filters.json][main][9e71b43cd430180easdfedfdfedfe0d6ee81ae53223e64c] Error parsing json {:source=>"message", :raw=>"{\n \"upsert\": {\n \"reference\": \"https://www.bbc.ca/en/events/#/details/14418\",\n \"metadata\": {\n \"author\": [\n \"BBC\"\n],\n \"body_content\": [\n \"BBC Content \"\n]\n },\n \"content\": \"content of BBC\"\n }\n}\n]", :exception=>#}
{
"@timestamp" => 2024-07-13T13:35:26.931027712Z,
"@version" => "1",
"event" => {
"original" => "{\n \"upsert\": {\n \"reference\": \"https://www.bbc.ca/en/events/#/details/14418\",\n \"metadata\": {\n \"author\": [\n \"BBC\"\n],\n \"body_content\": [\n \"BBC Content \"\n]\n },\n \"content\": \"content of BBC\"\n }\n}\n]"
},
"tags" => [
[0] "multiline",
[1] "_jsonparsefailure"
],
"log" => {
"file" => {
"path" => "/datadrive/json/test1.json"
}
},
"message" => "{\n \"upsert\": {\n \"reference\": \"https://www.bbc.ca/en/events/#/details/14418\",\n \"metadata\": {\n \"author\": [\n \"BBC\"\n],\n \"body_content\": [\n \"BBC Content \"\n]\n },\n \"content\": \"content of BBC\"\n }\n}\n]",
"host" => {
"name" => "ES-Demo"
}
}
```
---
### Author:  [@jessgarson](https://discuss.elastic.co/u/jessgarson)
#### Post date: [September 13, 2024, 3:39pm UTC](https://discuss.elastic.co/t/logstash-configuration-parsing-error/366543/2 "2024-09-13T15:39:33Z")
Welcome, @temp_data.
On a [StackOverflow post](https://stackoverflow.com/questions/33370753/logstash-json-filter-not-parsing-fields-getting-jsonparsefailure) about a similar topic, someone suggested using a JSON linting tool like [this one](https://jsonlint.com/), which could be helpful here.
---
### Author:  [@temp\_data](https://discuss.elastic.co/u/temp_data)
#### Post date: [September 13, 2024, 4:43pm UTC](https://discuss.elastic.co/t/logstash-configuration-parsing-error/366543/3 "2024-09-13T16:43:40Z")
@jessgarson Thank you for the hint, compressing the json and making it one line and using the basic setting work.
---
### Author:  [@jessgarson](https://discuss.elastic.co/u/jessgarson)
#### Post date: [September 13, 2024, 4:54pm UTC](https://discuss.elastic.co/t/logstash-configuration-parsing-error/366543/4 "2024-09-13T16:54:58Z")
Thanks for following up, @temp_data. Let us know if there anything else I can help you with here.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 13, 2024, 5:15pm UTC](https://discuss.elastic.co/t/logstash-configuration-parsing-error/366543/5 "2024-09-13T17:15:52Z")
The problem was your multiline codec. It consumes the second array entry (BBC) and the closing ] of the array as a single event, and that is not valid JSON, because the opening [ of the array is in a different event.