# Logstash error from Beats JSON input

**URL:** <https://discuss.elastic.co/t/logstash-error-from-beats-json-input/92028>\
**Category:** Logstash\
**Created:** [July 6, 2017, 7:19am UTC](https://discuss.elastic.co/t/logstash-error-from-beats-json-input/92028 "2017-07-06T07:19:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Renz\_Rollon](https://avatars.discourse-cdn.com/v4/letter/r/439d5e/32.png) [@Renz\_Rollon](https://discuss.elastic.co/u/Renz_Rollon)\
**Post date:** [July 6, 2017, 7:19am UTC](https://discuss.elastic.co/t/logstash-error-from-beats-json-input/92028/1 "2017-07-06T07:19:02Z")

</div>

Here's the log from **beats' publish** :  
{  
"@timestamp": "2017-07-06T07:12:12.629Z",  
"beat": {  
"hostname": "test",  
"name": "test",  
"version": "5.4.3"  
},  
"input\_type": "log",  
"message": "2017-07-06 07:12:03.082 INFO 26110 --- [nio-8090-exec-2] c.s.b.m.controller.DownloadController : Downloading Company List\_Draft\_HQ\_v89.1\_OD.xlsx\_output.csv",  
"offset": 32218,  
"source": "test.log",  
"type": "log"  
}  
2017-07-06T07:12:12Z DBG Publish: {  
"@timestamp": "2017-07-06T07:12:12.629Z",  
"beat": {  
"hostname": "test",  
"name": "test",  
"version": "5.4.3"  
},  
"input\_type": "log",  
"message": "2017-07-06 07:12:03.085 INFO 26110 --- [nio-8090-exec-2] c.s.b.m.controller.DownloadController : Sending output response..",  
"offset": 32345,  
"source": "test.log",  
"type": "log"  
}

However, on **logstash** , I receive this error:  
[2017-07-06T07:12:13,806][ERROR][logstash.codecs.json] JSON parse error, original data now in message field {:error=\>#\<LogStash::Json::ParserError: Unexpected character ('-' (code 45)): Expected space separating root-level values  
at [Source: 2017-07-06 07:12:03.082 INFO 26110 --- [nio-8090-exec-2] c.s.b.m.controller.DownloadController : Downloading Company List\_Draft\_HQ\_v89.1\_OD.xlsx\_output.csv; line: 1, column: 6]\>, :data=\>"2017-07-06 07:12:03.082 INFO 26110 --- [nio-8090-exec-2] c.s.b.m.controller.DownloadController : Downloading Company List\_Draft\_HQ\_v89.1\_OD.xlsx\_output.csv"}  
[2017-07-06T07:12:13,828][ERROR][logstash.codecs.json] JSON parse error, original data now in message field {:error=\>#\<LogStash::Json::ParserError: Unexpected character ('-' (code 45)): Expected space separating root-level values  
at [Source: 2017-07-06 07:12:03.085 INFO 26110 --- [nio-8090-exec-2] c.s.b.m.controller.DownloadController : Sending output response..; line: 1, column: 6]\>, :data=\>"2017-07-06 07:12:03.085 INFO 26110 --- [nio-8090-exec-2] c.s.b.m.controller.DownloadController : Sending output response.."}  
[2017-07-06T07:12:13,841][DEBUG][logstash.pipeline] filter received {"event"=\>{"@timestamp"=\>2017-07-06T07:12:12.629Z, "offset"=\>32218, "@version"=\>"1", "beat"=\>{"hostname"=\>"test", "name"=\>"test", "version"=\>"5.4.3"}, "input\_type"=\>"log", "host"=\>"test", "source"=\>"test.log", "message"=\>"2017-07-06 07:12:03.082 INFO 26110 --- [nio-8090-exec-2] c.s.b.m.controller.DownloadController : Downloading Company List\_Draft\_HQ\_v89.1\_OD.xlsx\_output.csv", "type"=\>"log", "tags"=\>["\_jsonparsefailure", "beats\_input\_codec\_json\_applied"]}}  
[2017-07-06T07:12:13,843][DEBUG][logstash.pipeline] filter received {"event"=\>{"@timestamp"=\>2017-07-06T07:12:12.629Z, "offset"=\>32345, "@version"=\>"1", "input\_type"=\>"log", "beat"=\>{"hostname"=\>"test", "name"=\>"test", "version"=\>"5.4.3"}, "host"=\>"test", "source"=\>"test..log", "message"=\>"2017-07-06 07:12:03.085 INFO 26110 --- [nio-8090-exec-2] c.s.b.m.controller.DownloadController : Sending output response..", "type"=\>"log", "tags"=\>["\_jsonparsefailure", "beats\_input\_codec\_json\_applied"]}}

Here is my logstash config:  
input {  
beats {  
port =\> "5044"  
host =\> "0.0.0.0"  
codec =\> "json"  
}  
}  
output {  
elasticsearch { hosts =\> ["10.40.11.130:9200"] }  
stdout {codec =\> json }  
}

What am I missing? Should I add a filter?

Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 9, 2017, 5:05pm UTC](https://discuss.elastic.co/t/logstash-error-from-beats-json-input/92028/2 "2017-07-09T17:05:00Z")

</div>

Your message clearly isn't JSON so don't use the json codec in the Logstash end.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2017, 5:05pm UTC](https://discuss.elastic.co/t/logstash-error-from-beats-json-input/92028/3 "2017-08-06T17:05:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.