# Logstash JSON iteration failure

**URL:** <https://discuss.elastic.co/t/logstash-json-iteration-failure/124492>\
**Category:** Logstash\
**Created:** [March 19, 2018, 7:02am UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492 "2018-03-19T07:02:14Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![satya\_sandeep](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@satya\_sandeep](https://discuss.elastic.co/u/satya_sandeep)\
**Post date:** [March 19, 2018, 7:02am UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/1 "2018-03-19T07:02:14Z")

</div>

I have a logstash script

filter {

```
json{
source=>"message"
target=>"dat"
}
split {
field => "[dat]"
}
split {
field => "[dat][friends]"
}

```

}

json message is :  
[  
{  
"\_id": "5aaf44772d97f524d9d11519",  
"index": 0,  
"guid": "ba92bd1b-5f5c-448f-9cc3-0462e51d5d32",  
"isActive": false,  
"tags": [  
"amet",  
"aliquip",  
"veniam",  
"officia",  
"incididunt",  
"do",  
"tempor"  
],  
"friends": [  
{  
"id": 0,  
"name": "Tami Rodriguez"  
},  
{  
"id": 1,  
"name": "Amalia Whitehead"  
},  
{  
"id": 2,  
"name": "Welch Molina"  
}  
]  
}]  
similar values are present i gave a single json  
I get the following warn:  
[2018-03-19T12:16:05,609][WARN][logstash.filters.split] Only String and Array types are splittable. field:[dat][friends] is of type = NilClass

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 19, 2018, 7:18am UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/2 "2018-03-19T07:18:05Z")

</div>

That indicates that there is no `[dat][friends]` field in the event. Comment out the split filters and inspect the resulting event with a `stdout { codec => rubydebug }` output. What does it look like?

---

<div class="post-metadata">

**Author:** ![satya\_sandeep](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@satya\_sandeep](https://discuss.elastic.co/u/satya_sandeep)\
**Post date:** [March 19, 2018, 7:56am UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/3 "2018-03-19T07:56:28Z")

</div>

{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.471Z,  
"message" =\> " {",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.472Z,  
"message" =\> " "\_id": "5aaf44772d97f524d9d11519",",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.474Z,  
"message" =\> " "index": 0,",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.475Z,  
"message" =\> " "guid": "ba92bd1b-5f5c-448f-9cc3-0462e51d5d32",",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.475Z,  
"message" =\> " "isActive": false,",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.475Z,  
"message" =\> " "friends": [",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.476Z,  
"message" =\> " {",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.476Z,  
"message" =\> " "id": 0,",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.476Z,  
"message" =\> " "name": "Tami Rodriguez"",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.476Z,  
"message" =\> " },",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.476Z,  
"message" =\> " {",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.476Z,  
"message" =\> " "id": 1,",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.477Z,  
"message" =\> " "name": "Amalia Whitehead"",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.478Z,  
"message" =\> " },",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.479Z,  
"message" =\> " {",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.480Z,  
"message" =\> " "id": 2,",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.484Z,  
"message" =\> " "name": "Welch Molina"",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.484Z,  
"message" =\> " }",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.485Z,  
"message" =\> " ]",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}  
{  
"@version" =\> "1",  
"@timestamp" =\> 2018-03-19T07:51:59.485Z,  
"message" =\> " }",  
"tags" =\> [  
[0] "\_jsonparsefailure"  
]  
}

---

<div class="post-metadata">

**Author:** ![satya\_sandeep](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@satya\_sandeep](https://discuss.elastic.co/u/satya_sandeep)\
**Post date:** [March 19, 2018, 8:07am UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/4 "2018-03-19T08:07:10Z")

</div>

I have checked the json it is fine but logstash says JSON parse failure

---

<div class="post-metadata">

**Author:** ![satya\_sandeep](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@satya\_sandeep](https://discuss.elastic.co/u/satya_sandeep)\
**Post date:** [March 19, 2018, 8:26am UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/5 "2018-03-19T08:26:48Z")

</div>

The first error was due to whitespaces and was rectified Now i can see properly formatted json in output but i am getting a 400 error saying :

Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"jsonit", :\_type=\>"event", :\_routing=\>nil}, #LogStash::Event:0x60dbc5ff], :response=\>{"index"=\>{"\_index"=\>"jsonit", "\_type"=\>"event", "\_id"=\>"yzRdPWIBNf-7tezaKSsV", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [dat]", "caused\_by"=\>{"type"=\>"illegal\_state\_exception", "reason"=\>"Can't get text on a START\_OBJECT at 1:2009"}}}}}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 19, 2018, 8:44am UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/6 "2018-03-19T08:44:31Z")

</div>

It looks like the `dat` field has already been mapped as a string but now you're trying to store an object in that field. If you don't have anything important in the index you can just delete it and start over.

---

<div class="post-metadata">

**Author:** ![satya\_sandeep](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@satya\_sandeep](https://discuss.elastic.co/u/satya_sandeep)\
**Post date:** [March 19, 2018, 8:46am UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/7 "2018-03-19T08:46:02Z")

</div>

ok will try that and get back to you thanks

---

<div class="post-metadata">

**Author:** ![satya\_sandeep](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@satya\_sandeep](https://discuss.elastic.co/u/satya_sandeep)\
**Post date:** [March 19, 2018, 8:47am UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/8 "2018-03-19T08:47:59Z")

</div>

It's working but what if the schema is changing in the index how do i update the type once it has been stored/mappped??

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 19, 2018, 8:52am UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/9 "2018-03-19T08:52:12Z")

</div>

The mapping of a field can't be changed without reindexing the data into a new index.

---

<div class="post-metadata">

**Author:** ![satya\_sandeep](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@satya\_sandeep](https://discuss.elastic.co/u/satya_sandeep)\
**Post date:** [March 19, 2018, 9:46am UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/10 "2018-03-19T09:46:28Z")

</div>

Thanks

---

<div class="post-metadata">

**Author:** ![satya\_sandeep](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@satya\_sandeep](https://discuss.elastic.co/u/satya_sandeep)\
**Post date:** [March 19, 2018, 1:08pm UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/11 "2018-03-19T13:08:39Z")

</div>

Hi Magnus, now the inner fields are not searchable like earlier i have two fields dat as a string and dat.keyword as a string

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 19, 2018, 1:19pm UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/12 "2018-03-19T13:19:19Z")

</div>

I don't know what you mean. What does an example document look like? What kind of search do you want to do? What are the results?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2018, 1:19pm UTC](https://discuss.elastic.co/t/logstash-json-iteration-failure/124492/13 "2018-04-16T13:19:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.