Logstash input json splitted by newline “\n”

Elastic Stack Logstash
1

I send the bulk to logstash where the jsons are separated by a newline.
it looks like that:

{"tenantId":"abcdefg","userSessionId":"zxxxxxxxxxxxxxx","startTime":1234,"endTime":12345,"duration":111,"internalUserId":"12345678","userType":"REAL_USER","applicationType":"WEB_APPLICATION","bounce":true,"newUser":true,"userActionCount":1,"totalErrorCount":0,"totalLicenseCreditCount":0,"matchingConversionGoalsCount":0,"ip":"0.0.0.0","browserType":"Desktop Browser","browserFamily":"Chrome","browserMajorVersion":"Chrome 116","osFamily":"Windows","osVersion":"Windows 10"}
{"tenantId":"abcdefgths","userSessionId":"xxxxxxxxxxxxxxxxxxx","startTime":1693,"endTime":16934,"duration":222,"internalUserId":"123456","userType":"REAL_USER","applicationType":"WEB_APPLICATION","bounce":true,"newUser":false,"userActionCount":1,"totalErrorCount":0,"totalLicenseCreditCount":0,"matchingConversionGoalsCount":0,"ip":"0.0.0.0","browserType":"Desktop Browser","browserFamily":"Chrome","browserMajorVersion":"Chrome 116","osFamily":"Windows","osVersion":"Windows 10"}

Logstash read only first line and rest is reject

My config:


input {
  http {
    host => "0.0.0.0"
    port => 5070
    codec => "json_lines"
  }
}

filter {
}


output {
  file {
#  codec => rubydebug{ metadata => true}
   path => "/tmp/test.txt"
  }
   stdout {
        codec => rubydebug{ metadata => true}
    }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.