# Logstash filter json warning

**URL:** <https://discuss.elastic.co/t/logstash-filter-json-warning/279352>\
**Category:** Logstash\
**Created:** [July 22, 2021, 8:00am UTC](https://discuss.elastic.co/t/logstash-filter-json-warning/279352 "2021-07-22T08:00:23Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [July 22, 2021, 8:00am UTC](https://discuss.elastic.co/t/logstash-filter-json-warning/279352/1 "2021-07-22T08:00:23Z")

</div>

Using ELK 7.13.2  
The logstash is consuming logs from kafka in json format earlier it was parsing the data but now it is not working

```auto
[2021-07-22T12:18:44,401][WARN][logstash.filters.json][ise][d51b308934c5e59604230fc981ad93b4109f63ea34e95a917c831d9b539476ad] Error parsing json {:source=>"message", :raw=>["{\"time\":\"2021-07-21T18:01:08+05:30\",\"tags\":\"ise\",\"proxied_srcip\":\"xx.xx.xx.xx\",\"message\":\"xxxxxx,xxxxxxx,xxxxxx,.....,\",\"host\":\"xxx\"}","NOTICE Passed-Authentication: Authentication succeeded"], :exception=>java.lang.ClassCastException}

```

it is not parsing any data

---

<div class="post-metadata">

**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\
**Post date:** [July 22, 2021, 1:26pm UTC](https://discuss.elastic.co/t/logstash-filter-json-warning/279352/2 "2021-07-22T13:26:40Z")

</div>

> [@Aniket\_Pant](#):
>
> `java.lang.ClassCastException`

Are you trying to convert a data type to another data type?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 22, 2021, 1:35pm UTC](https://discuss.elastic.co/t/logstash-filter-json-warning/279352/3 "2021-07-22T13:35:13Z")

</div>

What is the output you are getting in the `message` field?

From the error log I think that it is an array

```auto
:source=>"message", :raw=>["{\"time\":\"2021-07-21T18:01:08+05:30\",\"tags\":\"ise\",\"proxied_srcip\":\"xx.xx.xx.xx\",\"message\":\"xxxxxx,xxxxxxx,xxxxxx,.....,\",\"host\":\"xxx\"}","NOTICE Passed-Authentication: Authentication succeeded"]

```

It looks like that the `raw` part with the content of the field `message` has two itens.

Can you share your `message` field?

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [July 23, 2021, 9:06am UTC](https://discuss.elastic.co/t/logstash-filter-json-warning/279352/4 "2021-07-23T09:06:00Z")

</div>

no i am not converting anything.

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [July 23, 2021, 9:14am UTC](https://discuss.elastic.co/t/logstash-filter-json-warning/279352/5 "2021-07-23T09:14:39Z")

</div>

In kafka the message is stored as in json format

```auto
{"time":"2021-07-23T12:28:19+05:30","tags":"ise","proxied_srcip":"xx.xx.xx.xx","message":"xxxx","host":"xxxxxx"}

```

logstash logs

```auto
[2021-07-23T14:39:22,724][WARN][logstash.filters.json][ise][d6b83eeca151b16126379e73295e113853498156da958a0e9df1e6c386d3e473] Error parsing json {:source=>"message", :raw=>["{\"time\":\"2021-07-23T14:32:02+05:30\",\"tags\":\"ise\",\"proxied_srcip\":\"xx.xx.xx.xx\",\"message\":\"xxxx\",\"host\":\"xxx\"}", "NOTICE Passed-Authentication: Authentication succeeded"], :exception=>java.lang.ClassCastException: class org.jruby.RubyArray cannot be cast to class org.jruby.RubyIO (org.jruby.RubyArray and org.jruby.RubyIO are in unnamed module of loader 'app')}

```

I don't know why i am getting this i resolve this by restarting the logstash but after some hours it shows the warning like

```auto
[WARN][logstash.filters.json] and [WARN][logstash.filters.grook]

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 23, 2021, 12:14pm UTC](https://discuss.elastic.co/t/logstash-filter-json-warning/279352/6 "2021-07-23T12:14:48Z")

</div>

Can you share your pipeline?

Also, how are you sending the data to kafka?

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [July 25, 2021, 3:16pm UTC](https://discuss.elastic.co/t/logstash-filter-json-warning/279352/7 "2021-07-25T15:16:56Z")

</div>

Hey @leandrojmp the warning is not coming the new issue is filter grok i have to open this issue

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2021, 3:17pm UTC](https://discuss.elastic.co/t/logstash-filter-json-warning/279352/8 "2021-08-22T15:17:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.