Logstash JSON ParserError: Unexpected characher '-'

Elastic Stack Logstash
1

It appears that LogStash doesn't like hyphens or something?

These are IIS logs by the way. I get this error in my date field:

[2019-05-28T16:35:58,176][WARN ][logstash.codecs.jsonlines] JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected character ('-' (code 45)): Expected space separating root-level values
at [Source: (String)"2019-05-27....(data)....line: 1, column: 6.....(data)....

Column 6 is the hyphen after 2019. Any ideas?

2

You are ingesting IIS logs with a json_lines codec? Last I looked IIS does not log in JSON format. Remove the codec from the input.

3

Ah OK. That must be what I was misunderstanding, logically speaking. I was thinking it was needed to process JSON data. I'll give that a try and post back if it doesn't work.

Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.