Logstash picking up JSON over TCP has non-json 1st line

[yungnvn (Naveen)]

Hi,

We are trying to send some metric data over TCP for AIX machines and we are using njmon (a variation of nmon which can send JSON formatted metrics). The way its currently set up, njmon sends the following:

B@?=4zG?M&?@? >649> T1G4!?{@/rB 0[rLM[LMrrY0Z|[L|r[ (O#$OY r0 B9q1=4zG?M&?@?{
  {
     "identity": {
          "hostname": "hostname",
          "fullhostname": "hostname",
          "njmon_command": "/usr/lbin/njmon_aix71_v31 -s 10 -c 1440 -i 10.10.10.10 -p 3000 -X SECRET",
          "njmon_version": "31@17/07/2019",
          "username": "root",
          "userid": 0
     },
     "timestamp": {
          "datetime": "2019-09-11T16:09:20",
          "UTC": "2019-09-11T23:09:20",
          "snapshot_seconds": 10,
          "snapshot_maxloops": 1440,
          "snapshot_loop": 0
     },
     "config": {
          "partitionname": "hostname",
          "nodename": "hostname",
          "processorFamily": "POWER8",
          "processorModel": "IBM,8408-E8E",
          "machineID": "215A4EW",
          "processorMHz": 3359.000,
          "pcpu_max": 40,
          "pcpu_online": 39,
          "OSname": "AIX",
          "OSversion": "7.1",
          "OSbuild": "Oct 26 2018 12:04:54 1843B_71c",
          "lcpus": 8,
          "smtthreads": 8,
          "drives": 3,
          "nw_adapter": 3,
          "cpucap_min": 10,
          "cpucap_max": 400,
          "cpucap_desired": 0,
          "cpucap_online": 0,
          "cpucap_weightage": 128,
          "entitled_proc_capacity": 0.100,
          "vcpus_min": 1,
          "vcpus_max": 4,
          "vcpus_desired": 0,
          "vcpus_online": 1,
          "processor_poolid": 0,
          "activecpusinpool": 39,
     }
   }
 }
|
| more data
| 

We're trying to stop sending the 1st line but is there any way to tell logstash to ignore the first line and only start at the first {?

Thanks for the help!

[Badger]

You could use mutate to remove the first line.

mutate { gsub => [ "message", "\A[^
]+
", "" ] }

[yungnvn (Naveen)]

Thank you! I was able to get it fixed using that.