# Logstash picking up JSON over TCP has non-json 1st line

**URL:** <https://discuss.elastic.co/t/logstash-picking-up-json-over-tcp-has-non-json-1st-line/199338>\
**Category:** Logstash\
**Created:** [September 13, 2019, 12:32am UTC](https://discuss.elastic.co/t/logstash-picking-up-json-over-tcp-has-non-json-1st-line/199338 "2019-09-13T00:32:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yungnvn](https://avatars.discourse-cdn.com/v4/letter/y/71e660/32.png) [@yungnvn](https://discuss.elastic.co/u/yungnvn)\
**Post date:** [September 13, 2019, 12:32am UTC](https://discuss.elastic.co/t/logstash-picking-up-json-over-tcp-has-non-json-1st-line/199338/1 "2019-09-13T00:32:39Z")

</div>

Hi,

We are trying to send some metric data over TCP for AIX machines and we are using njmon (a variation of nmon which can send JSON formatted metrics). The way its currently set up, njmon sends the following:

```auto
B@?=4zG?M&?@? >649> T1G4!?{@/rB 0[rLM[LMrrY0Z|[L|r[ (O#$OY r0 B9q1=4zG?M&?@?{
  {
     "identity": {
          "hostname": "hostname",
          "fullhostname": "hostname",
          "njmon_command": "/usr/lbin/njmon_aix71_v31 -s 10 -c 1440 -i 10.10.10.10 -p 3000 -X SECRET",
          "njmon_version": "31@17/07/2019",
          "username": "root",
          "userid": 0
     },
     "timestamp": {
          "datetime": "2019-09-11T16:09:20",
          "UTC": "2019-09-11T23:09:20",
          "snapshot_seconds": 10,
          "snapshot_maxloops": 1440,
          "snapshot_loop": 0
     },
     "config": {
          "partitionname": "hostname",
          "nodename": "hostname",
          "processorFamily": "POWER8",
          "processorModel": "IBM,8408-E8E",
          "machineID": "215A4EW",
          "processorMHz": 3359.000,
          "pcpu_max": 40,
          "pcpu_online": 39,
          "OSname": "AIX",
          "OSversion": "7.1",
          "OSbuild": "Oct 26 2018 12:04:54 1843B_71c",
          "lcpus": 8,
          "smtthreads": 8,
          "drives": 3,
          "nw_adapter": 3,
          "cpucap_min": 10,
          "cpucap_max": 400,
          "cpucap_desired": 0,
          "cpucap_online": 0,
          "cpucap_weightage": 128,
          "entitled_proc_capacity": 0.100,
          "vcpus_min": 1,
          "vcpus_max": 4,
          "vcpus_desired": 0,
          "vcpus_online": 1,
          "processor_poolid": 0,
          "activecpusinpool": 39,
     }
   }
 }
|
| more data
| 

```

We're trying to stop sending the 1st line but is there any way to tell logstash to ignore the first line and only start at the first `{`?

Thanks for the help!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 13, 2019, 1:01pm UTC](https://discuss.elastic.co/t/logstash-picking-up-json-over-tcp-has-non-json-1st-line/199338/2 "2019-09-13T13:01:28Z")

</div>

You could use mutate to remove the first line.

```
mutate { gsub => [ "message", "\A[^
]+
", "" ] }
```

---

<div class="post-metadata">

**Author:** ![yungnvn](https://avatars.discourse-cdn.com/v4/letter/y/71e660/32.png) [@yungnvn](https://discuss.elastic.co/u/yungnvn)\
**Post date:** [September 16, 2019, 9:48pm UTC](https://discuss.elastic.co/t/logstash-picking-up-json-over-tcp-has-non-json-1st-line/199338/3 "2019-09-16T21:48:02Z")

</div>

Thank you! I was able to get it fixed using that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 14, 2019, 9:48pm UTC](https://discuss.elastic.co/t/logstash-picking-up-json-over-tcp-has-non-json-1st-line/199338/4 "2019-10-14T21:48:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.