# Logstash only reading first JSON line

**URL:** <https://discuss.elastic.co/t/logstash-only-reading-first-json-line/115997>\
**Category:** Logstash\
**Created:** [January 18, 2018, 8:34am UTC](https://discuss.elastic.co/t/logstash-only-reading-first-json-line/115997 "2018-01-18T08:34:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [January 18, 2018, 8:34am UTC](https://discuss.elastic.co/t/logstash-only-reading-first-json-line/115997/1 "2018-01-18T08:34:49Z")

</div>

Hi,

Suddenly my S3 input stopped processing complete files. This morning the same files in the same bucket were processed just fine, but after deleting some files, the remaining files suddenly only have the first JSON line processed per file and the reset is ignored. I did not make any changes anywhere.

I'm testing with only 3 files now each containing only a dozen or so JSON entries so performance shouldn't be the issue.

JSON example:

```auto
{"@timestamp":"2018-01-18T13:44:44.000Z","state":"LOGGED IN"}{"@timestamp":"2018-01-18T13:44:44.000Z","Eb":"01.6"}{"@timestamp":"2018-01-18T13:45:20.000Z","hrs":"100"}
```

config

```auto
input {
  s3 {
    access_key_id => "secret"
    secret_access_key => "secret"
    region => "eu-west-2"
    bucket => "testbucket"
    sincedb_path => "/dev/null"
    codec => "json"
  }
}

filter {
  mutate {
     remove_field => ["@version"]
  }
  ruby {
     code => 'event.set("@ingest_time", Time.now.strftime("%Y-%m-%dT%H:%M"))'
  }
}

output {
  stdout {
     codec => rubydebug
  }
}
```

What is going on? If I remove the json codec I do see the whole message appearing.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 15, 2018, 8:35am UTC](https://discuss.elastic.co/t/logstash-only-reading-first-json-line/115997/2 "2018-02-15T08:35:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.