### Author:  [@chowdary](https://discuss.elastic.co/u/chowdary)
#### Post date: [September 19, 2018, 11:37am UTC](https://discuss.elastic.co/t/logstash-json-filter-error/149117/1 "2018-09-19T11:37:04Z")
Hi ,
i am facing below error, while running the logstash .
←[33mError parsing json {:source=\>"message", :raw=\>"}\r", :exception=\>#\, :level=\>:warn}←[0m
{
Thanks in advance
Chow
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 20, 2018, 5:22pm UTC](https://discuss.elastic.co/t/logstash-json-filter-error/149117/2 "2018-09-20T17:22:16Z")
You probably have a multiline JSON file that you're not joining to a single event in a correct way, but without seeing your configuration and some sample input we can only guess.
---
### Author:  [@chowdary](https://discuss.elastic.co/u/chowdary)
#### Post date: [September 20, 2018, 6:09pm UTC](https://discuss.elastic.co/t/logstash-json-filter-error/149117/3 "2018-09-20T18:09:10Z")
Hi,
Please find configuration .
logstash configuration
input {
file {
path =\> "C:\Logs\test.log"
start\_position =\> "beginning"
codec =\> multiline {
pattern =\> "^{"
negate =\> true
what =\> previous
```
}
```
}
}
filter {
json {
source =\> "message"
}
}
if I am not used any filters getting below output . , in that out put total my log is coming in message field. if i used json filters, multi line field is not working. getting error .
output
{
"@timestamp" =\> "2018-09-20T10:35:56.993Z",
"message" =\> "{\r\n"SourceId" : "99fc846d-cdd0-547e-babb-54c514616e9d",\r\n"EventId" : "1",\r\n"Keywords" : "1",\r\n"Level" : "Verbose",\r\n"Message" : "",\r\n"Opcode" : "Info",\r\n"Task" : "65533 WriteVerbose",\r\n"Version" : "0",\r\n"Timestamp" : "2018-09-
18T15:19:40.6927540Z",\r\n"Payload\_message" : "Message received by NotificationSvcTwoWayImplementation. Set logging level above verbose to disable this message.",\r\n"Payload\_MessageType" : "GetPatientNotifications",\r\n"Payload\_MedseekPatientId" : "d209854e-c3c1-4999-aade-20819559c5da"
,\r\n"payload\_exception " : "this is the exception while connecting the server\r\nserver abc ip of em server\r\nabcd\r\nefgh\r\nexception not resolved"\r\n"Payload\_OriginatingMessageId" : "234d3d88-2a9f-4fcb-b983-8dc08dd36bbc",\r\n"EOE" : ""\r\n}\r",
"@version" =\> "1",
"tags" =\> [
[0] "multiline",
[1] "\_jsonparsefailure"
],
"path" =\> "C:\Medseek\Logs\testfilter.log",
}
output for above logstash conf
{
"@timestamp" =\> "2018-09-20T10:50:25.723Z",
"@version" =\> "1",
"path" =\> "C:\Medseek\Logs\testfilter.log",
"host" =\> "AZ-AQA-COM-01",
"SourceId" =\> "444444-cdd0-547e-babb-1212121",
"EventId" =\> "1",
"Keywords" =\> "1",
"Level" =\> "Verbose",
"Message" =\> "",
"Opcode" =\> "Info",
"Task" =\> "65533 WriteVerbose",
"Version" =\> "0454",
"Timestamp" =\> "2018-09-18T15:19:40.6927540Z",
"Payload\_message" =\> "Message received this message.",
"Payload\_MessageType" =\> "getting",
"Payload\_MedseekPatientId" =\> "444-454545-4999-aade-45454",
"Payload\_OriginatingMessageId" =\> "454-2a9f-454545454-b983-454545454",
"EOE" =\> ""
}
expecting output:
{
"@timestamp" =\> "2018-09-20T10:50:25.723Z",
"@version" =\> "1",
"path" =\> "C:\Medseek\Logs\testfilter.log",
"host" =\> "AZ-AQA-COM-01",
"SourceId" =\> "444444-cdd0-547e-babb-1212121",
"EventId" =\> "1",
"Keywords" =\> "1",
"Level" =\> "Verbose",
"Message" =\> "",
"Opcode" =\> "Info",
"Task" =\> "65533 WriteVerbose",
"Version" =\> "0454",
"Timestamp" =\> "2018-09-18T15:19:40.6927540Z",
"Payload\_message" =\> "Message received this message.",
"Payload\_MessageType" =\> "getting",
"Payload\_MedseekPatientId" =\> "444-454545-4999-aade-45454",
"Payload\_Exception" : "at System.Xml..6666666.exception exception exception exception exception
at office.Xml.454544544.exception exception exception exception exception
at ntegration.555555.exception exception exception exception exception
"Payload\_OriginatingMessageId" =\> "454-2a9f-454545454-b983-454545454",
"EOE" =\> ""
}
multi line field (exception field ) also should come one filed . i tried but no luck.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 20, 2018, 8:19pm UTC](https://discuss.elastic.co/t/logstash-json-filter-error/149117/4 "2018-09-20T20:19:24Z")
This question is a duplicate of another thread.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 18, 2018, 8:19pm UTC](https://discuss.elastic.co/t/logstash-json-filter-error/149117/5 "2018-10-18T20:19:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.