# Logstash JSON Parse error.... With valid JSON data **URL:** \ **Category:** Logstash\ **Created:** [May 19, 2016, 3:10pm UTC](https://discuss.elastic.co/t/logstash-json-parse-error-with-valid-json-data/50455 "2016-05-19T15:10:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jstmatt](https://avatars.discourse-cdn.com/v4/letter/j/c68b51/32.png) [@jstmatt](https://discuss.elastic.co/u/jstmatt)\ **Post date:** [May 19, 2016, 3:10pm UTC](https://discuss.elastic.co/t/logstash-json-parse-error-with-valid-json-data/50455/1 "2016-05-19T15:10:20Z")
Hi All, We have an issue where data from Filebeat (1.2.2) is being read from files, sent to Logstash (2.3.1). We are receiving, regularly, errors stating that the data can not be parsed. I verified that the JSON is, in fact JSON via [jsonlint.com](http://jsonlint.com). MOST of the other entries are making it without issue. Is it perhaps the "\t" in the sd key pair that is causing the issue i.e. "sd":"Yamaha\tXVZ 1300 A Royal Star (4YP3) (Europe)\t1999 Goldfren S33 Rear Brake Pads" and if so, how would we resolve this? Thanks in advance!!! **So the JSON data looks like this:** {"ts":"2016-05-19 06:59:29.427 -0700","opp":"GRC","ti":"e2169334-ec99-46bd-bad5-0a36f2a7a67c","dv":1286,"flg":0,"cc":1,"ctyc":3,"ctgc":1,"idc":3,"attc":1,"chsl":[["871410"]],"ctl":[[["177925"]]],"csil":[["3"]],"ew":2.8900,"emv":2,"ebayid":[["301961033655"]],"al":[[[{"n":"CDN","v":"1000"}]]],"chss":5,"cszs":13,"nacchs":1,"naccsz":1,"naccwgt":1,"emd":"ESTIMATE\_CURRENT\_VERSION","sd":"Yamaha\tXVZ 1300 A Royal Star (4YP3) (Europe)\t1999 Goldfren S33 Rear Brake Pads","idl":[[[{"rfid":"301961033655","t":"COMMODITYID"},{"rfid":"301961033655","t":"EBAYITEMID"},{"rfid":"Goldfren","t":"BRAND"}]]],"accci":{"acoi":"301961033655","acohs":"871410","acohsq":0.2903,"acov":2},"szsm":10,"hssm":4,"spr":[[14.50]],"accdu":2,"atc":71,"mrc":"EBAY\_0002","ccl":[[[{"t":"SALEPRICE","v":14.5}]]],"dssl":[[["309","314"]]],"lt":"BIN\_ONLY","du":4,"cct":1,"rl":[{"sid":"STANDARD\_UK","cty":"US","rstl":["IMPORT"]},{"sid":"STANDARD\_UK","cty":"MY","rstl":["IMPORT"]},{"sid":"STANDARD\_UK","cty":"IL","rstl":["IMPORT"]}],"frl":["US","MY","IL"]} **The error seen is:** {:timestamp=\>"2016-05-19T06:59:34.387000-0700", :message=\>"JSON parse failure. Falling back to plain-text", :error=\>#\, :data=\>"{"ts":"2016-05-19 06:59:29.457 -0700","opp":"ACC","ipl":{"rcom":{"ttl":"Yamaha\tXVZ 1300 A Royal Star (4YP3) (Europe)\t1999 Goldfren S33 Rear Brake Pads",":ctlt":[{"ctcd":"003-177925","ispr":"true"}],":ids":[{"ref":"TRANSACTIONID","val":"e2169334-ec99-46bd-bad5-0a36f2a7a67c"},{"ref":"LISTING\_TYPE","val":"BIN\_ONLY"},{"ref":"EBAYITEMID","val":"301961033655"},{"ref":"BRAND","val":"Goldfren"}],"prc":14.5000,"ever":"CURRENT","elvl":"SIX\_DIGIT","nump":null,"merc":"EBAY\_0002","pret":"[HSCODE, WEIGHT, SIZE]"}},"rpl":{"com":{":clrt":[{"hs":"871410","hsqf":null,"hsq6":0.29031159591716540000,"wgt":null,"wq":null,"sz":null,"szq":null}],"pkv":2,"clst":1}}}", :level=\>:error} **The filebeat.yml config looks like this:** filebeat: prospectors: - paths: - C:\pb\apache-tomcat-7.0.22\logs\xbec\_events.log - C:\docume~1\alluse~1\filebeat\logs\mybeat.log - C:\pb\apache-tomcat-7.0.22\logs\xbec\_transactions.log input\_type: log ignore\_older: 10m close\_older: 10m scan\_frequency: 2s harvester\_buffer\_size: 200 spool\_size: 200 idle\_timeout: 10s registry\_file: "C:/docume~1/alluse~1/filebeat/registry/registry.file" output: logstash: hosts: ["10.94.126.49:9990", "10.94.166.20:9990", "10.86.174.18:9990", "10.86.170.19:9990"] worker: 3 loadbalance: true max\_retries: 0 logging: to\_files: true files: path: "c:/DOCUME~1/ALLUSE~1/filebeat/logs" name: mybeat.log rotateeverybytes: 10485760 # = 20MB level: warning **And the logstash.conf looks like this:** input { beats { type=\> beats port =\> 9990 codec =\> "json" } beats { type=\> beats port =\> 9991 codec =\> "json" } } filter { json { source =\> message } } output { s3{ access\_key\_id =\> "xyz" secret\_access\_key =\> "xyz" region =\> "us-west-2" bucket =\> "bucketname" canned\_acl =\> "authenticated\_read" size\_file =\> 50000000 time\_file =\> 1 upload\_workers\_count =\> 20 prefix =\> "1-server1/" codec =\> "json\_lines" temporary\_directory =\> "/data/logstash/forwarder-other" restore =\> true } ---
**Author:** ![jstmatt](https://avatars.discourse-cdn.com/v4/letter/j/c68b51/32.png) [@jstmatt](https://discuss.elastic.co/u/jstmatt)\ **Post date:** [May 25, 2016, 8:41pm UTC](https://discuss.elastic.co/t/logstash-json-parse-error-with-valid-json-data/50455/2 "2016-05-25T20:41:01Z")
Anyone else seen an issue like this? Thanks ---
**Author:** ![DenysK](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/denysk/32/16309_2.png) [@DenysK](https://discuss.elastic.co/u/DenysK)\ **Post date:** [April 3, 2017, 3:51pm UTC](https://discuss.elastic.co/t/logstash-json-parse-error-with-valid-json-data/50455/3 "2017-04-03T15:51:12Z")
The same issue with JSON sent over TCP ---
**Author:** ![felixon](https://avatars.discourse-cdn.com/v4/letter/f/c77e96/32.png) [@felixon](https://discuss.elastic.co/u/felixon)\ **Post date:** [May 28, 2017, 7:39am UTC](https://discuss.elastic.co/t/logstash-json-parse-error-with-valid-json-data/50455/4 "2017-05-28T07:39:48Z")
has any one managed to solve this\> ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 28, 2017, 10:29am UTC](https://discuss.elastic.co/t/logstash-json-parse-error-with-valid-json-data/50455/5 "2017-05-28T10:29:23Z")
I am not sure if this was solved, but the use of both a json codec for the input as well as a separate json filter looks odd to me. When you encounter an issue like this, it usually helps to replace all outputs with a stdout output filter with a rubydebug codec set, as this makes it fast and easy to debug. Then add a codec and/or filter at a time and observe the result. If you want assistance with this it is probably better to open a new thread and provide your config. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:26am UTC](https://discuss.elastic.co/t/logstash-json-parse-error-with-valid-json-data/50455/6 "2017-07-06T04:26:18Z")