Logstash unable to parse a simple json

Elastic Stack Logstash
1

I am just trying to read the simplest json possible via logstash and send it to elasticsearch.

input json file:

{
  "preview": false
}

input config

input {

  file {
    path => "/usr/share/logstash/files/sample_data_simple.json"
    start_position => "beginning"
    codec => json
    tags => ["sometag"]
  }

filter config

filter {

}

output config

output {
  elasticsearch {
        hosts => ["elasticsearch:9200"]
        index => "someindex"
        document_type => _doc
      }
}

getting ...

logstash_1       | [2018-07-03T06:45:58,675][ERROR][logstash.codecs.json     ] JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected end-of-input: expected close marker for Object (start marker at [Source: (String)"{"; line: 1, column: 1])
logstash_1       |  at [Source: (String)"{"; line: 1, column: 3]>, :data=>"{"}
logstash_1       | [2018-07-03T06:45:58,754][ERROR][logstash.codecs.json     ] JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: incompatible json object type=java.lang.String , only hash map or arrays are supported>, :data=>"  \"preview\": false"}
logstash_1       | [2018-07-03T06:45:58,757][ERROR][logstash.codecs.json     ] JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected close marker '}': expected ']' (for root starting at [Source: (String)"}"; line: 1, column: 0])
2

The file input reads files line by line. If you want to read the whole file into a single Logstash event you need to use a multiline codec. Examples of this have been posted in the past.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.