# Logstash ruby code plugin validate JSON

**URL:** <https://discuss.elastic.co/t/logstash-ruby-code-plugin-validate-json/340889>\
**Category:** Logstash\
**Created:** [August 16, 2023, 9:01am UTC](https://discuss.elastic.co/t/logstash-ruby-code-plugin-validate-json/340889 "2023-08-16T09:01:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![z\_z](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/z_z/32/124653_2.png) [@z\_z](https://discuss.elastic.co/u/z_z)\
**Post date:** [August 16, 2023, 9:01am UTC](https://discuss.elastic.co/t/logstash-ruby-code-plugin-validate-json/340889/1 "2023-08-16T09:01:42Z")

</div>

My logstash.conf is as follows, it is used to read data from events.txt and use ruby code plugin to add tag to non json event.

```auto
input {
    file {
        path => ["/home/events.txt"]
        start_position => "beginning"
        sincedb_path=> "/dev/null"
    }
}

filter {
    ruby {
        
        code => "
                begin
                    parsed = LogStash::Json.load(source)
                rescue => e
                    event.tag('_jsoncheckfailure')
                    # event.cancel
                end
        "
    }

    json {
        source => "message"
    }
}

output {
    stdout { codec => rubydebug { metadata => true } }
}

```

events.txt is as follows

```auto
{"id":1,"something":"text1"}
{"id":23,"something":"text1"}
fafgag

```

and the result log is as follows

```auto
{
    "@timestamp" => 2023-08-16T08:48:42.443091400Z,
           "log" => {
        "file" => {
            "path" => "/home/events.txt"
        }
    },
     "@metadata" => {
        "host" => "3097239bf923",
        "path" => "/home/events.txt"
    },
          "host" => {
        "name" => "3097239bf923"
    },
      "@version" => "1",
            "id" => 23,
         "event" => {
        "original" => "{\"id\":23,\"something\":\"text1\"}"
    },
       "message" => "{\"id\":23,\"something\":\"text1\"}",
     "something" => "text1",
          "tags" => [
        [0] "_jsoncheckfailure"
    ]
}
{
    "@timestamp" => 2023-08-16T08:48:42.443449300Z,
           "log" => {
        "file" => {
            "path" => "/home/events.txt"
        }
    },
     "@metadata" => {
        "host" => "3097239bf923",
        "path" => "/home/events.txt"
    },
          "host" => {
        "name" => "3097239bf923"
    },
      "@version" => "1",
         "event" => {
        "original" => "fafgag"
    },
       "message" => "fafgag",
          "tags" => [
        [0] "_jsoncheckfailure",
        [1] "_jsonparsefailure"
    ]
}
{
    "@timestamp" => 2023-08-16T08:48:42.438113200Z,
           "log" => {
        "file" => {
            "path" => "/home/events.txt"
        }
    },
     "@metadata" => {
        "host" => "3097239bf923",
        "path" => "/home/events.txt"
    },
          "host" => {
        "name" => "3097239bf923"
    },
      "@version" => "1",
            "id" => 1,
         "event" => {
        "original" => "{\"id\":1,\"something\":\"text1\"}"
    },
       "message" => "{\"id\":1,\"something\":\"text1\"}",
     "something" => "text1",
          "tags" => [
        [0] "_jsoncheckfailure"
    ]
}

```

It seems the `LogStash::Json.load(source) `does not work, but I check the code with json plugin, the json plugin also uses the code to parse json.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 13, 2023, 9:02am UTC](https://discuss.elastic.co/t/logstash-ruby-code-plugin-validate-json/340889/2 "2023-09-13T09:02:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.