Logstash stops processing input on malformed JSON line

Elastic Stack Logstash
1

Hello!
I have logstash 5.2.2 reading files containing data in JSON format.
When logstash encounters a malformed line it throws error and stops processing the whole input

config:
input { file { path => "c:/programdata/monitoring/logs/**/*.log" codec =>"json" sincedb_path => "c:/programdata/Shipper/Work/sincedb"} }

Error:

[2017-03-06T17:58:56,723][ERROR][logstash.codecs.json ] JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Illegal unquoted character ((CTRL-CHAR, code 9)): has to be escaped using backslash to be included in name
at [Source: ................MORE............

[2017-03-06T17:58:56,911][ERROR][logstash.codecs.json ] JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unrecognized token ...........MORE.............

Any idea?

2

Any ideas guys?

3

It might be worthwhile trying to use a json filter instead of the json codec, as this may allow you to handle parsing failures more gracefully. I have however not tested it.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.