# Logstash filter JSON parse error
**URL:** https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918
**Category:** Logstash
**Created:** [February 4, 2026, 7:05pm UTC](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918 "2026-02-04T19:05:58Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@rokkotnik](https://discuss.elastic.co/u/rokkotnik)
#### Post date: [February 4, 2026, 7:05pm UTC](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918/1 "2026-02-04T19:05:58Z")
Hi,
I keep getting json parse error and I’ve been playing with filter for hours.
[logstash.codecs.json][main][68389d] JSON parse error, original data now in message field {:message=\>"Could not set field 'ip' on object 'gitlab.domain.si' to value '10.0.1.22’This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string"
I am getting my logs from logspout
```auto
input {
udp {
port => 5044
codec => json
}
}
```
Any idea how to adjust my filter to avoid this or do something about it?
Thanks!
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [February 4, 2026, 10:06pm UTC](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918/2 "2026-02-04T22:06:30Z")
Welcome to the community!
Try to set `ecs_compatibility: disabled` , default value is `pipeline.ecs_compatibility: v8` in logstash.yml.It's enough to set on the plugin level.
Without ECS you will review your data to find what cause an error. Of course you can use ruby debug in output.
```auto
udp {
port => 5044
ecs_compatibility => disabled
codec => json
}
```
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 4, 2026, 11:31pm UTC](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918/3 "2026-02-04T23:31:38Z")
Hello and welcome,
Can you share a sample of your message?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 5, 2026, 4:50am UTC](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918/4 "2026-02-05T04:50:41Z")
> [@rokkotnik](#):
>
> I keep getting json parse error
I know it can be frustrating,
This [answer](https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750/2) might help, but it doesn’t go into details, so you will have to work on it.
Providing a single reproducible example will allow me, Leandro, Rios, David, or others to provide much more customised advice.
Please show us the problem, not just the error message.
---
### Author:  [@rokkotnik](https://discuss.elastic.co/u/rokkotnik)
#### Post date: [February 5, 2026, 7:50am UTC](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918/5 "2026-02-05T07:50:01Z")
Thank you all. This is my ELK (elastic, logstash, kibana and logspout stack on my docker swarm developer stack. Gitlab service is giving me this messages)🙂
my config logstash:
```auto
input {
udp {
port => 5044
codec => json
}
}
filter {
#Drop internal Logstash logs
if [docker][image] =~ /^logstash/ {
drop { }
}
}
```
and example error:
`elk_logstash.0.xxxxx@node | [2026-02-05T07:46:38,710][ERROR][logstash.codecs.json][main][]`
`JSON parse error, original data now in message field {`
`:message => "Could not set field 'ip' on object 'example.host'`
`to value 'X.X.X.X'.`
`This is probably due to trying to set a field like [foo][bar] = someValue`
`when [foo] is not either a map or a string",`
`:exception => Java::OrgLogstash::Accessors::InvalidFieldSetException,`
`:data => "{`
`"backend_id":"rails",`
`"body_limit":104857600,`
`"correlation_id":"",`
`"docker":{`
`"name":"/stack_service.1.xxxxx",`
`"id":"",`
`"image":"gitlab/gitlab-ee:",`
`"hostname":"",`
`"labels":{`
`"com_docker_stack_namespace":"",`
`"com_docker_swarm_service_name":""`
`}`
`},`
`"duration_ms":0,`
`"host":"example.host",`
`"level":"info",`
`"method":"POST",`
`"msg":"access",`
`"proto":"HTTP/1.1",`
`"read_bytes":1659,`
`"remote_addr":"X.X.X.X:0",`
`"remote_ip":"X.X.X.X",`
`"route":"^/api/v4/jobs/request\\z",`
`"status":204,`
`"stream":"stdout",`
`"system":"http",`
`"time":"2026-02-05T07:46:38Z",`
`"uri":"/api/v4/jobs/request",`
`"user_agent":"gitlab-runner ",`
`"written_bytes":0`
`}"`
`}`
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [February 5, 2026, 9:00am UTC](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918/6 "2026-02-05T09:00:41Z")
> `"Could not set field 'ip' on object 'example.host'`
> `to value 'X.X.X.X'.`
You have the hostname in the ip address field. Please disable ECS and try again.
---
### Author:  [@rokkotnik](https://discuss.elastic.co/u/rokkotnik)
#### Post date: [February 6, 2026, 8:59am UTC](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918/7 "2026-02-06T08:59:20Z")
> [@Rios](#):
>
> ecs\_compatibility: disabled
With: “ecs\_compatibility =\> disabled”
`input {`
`udp {`
`port => 5044`
`codec => json`
`ecs_compatibility => disabled`
`}`
`}`
My logs are not going to the elastic and kibana
Could not index event to Elasticsearch. {:status=\>400, :action=\>["create", {:\_id=\>nil, :\_index=\>"logs-audit-default", :routing=\>nil}, {"message"=\>"23.88.100.84 - - [06/Feb/2026:08:58:11 +0000] "POST /api/v4/jobs/request HTTP/1.1" 204 0 "" "gitlab-runner 18.3.0~pre.154.g3ecc71b2 (main; go1.24.4 X:cacheprog; linux/amd64)" -", "stream"=\>"stdout", "tags"=\>, "@version"=\>"1", "@timestamp"=\>2026-02-06T08:58:11.058178336Z,……
"reason"=\>"[1:2937] object mapping for [host] tried to parse field [host] as object, but found a concrete value"}
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [February 6, 2026, 12:42pm UTC](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918/8 "2026-02-06T12:42:06Z")
You have issue with data mapping because ECS and non ECS data structure is the same.
Can you use another index i.e. _testindex_ or delete existing with data mapping/view?
As Badger said **please** provide us with:
- data sample
- full input/output section, it's not the same if you sending data in filebeat or logstash indices because data mapping is not same and not possible to change, except in some cases.