# Logstash updating not working

**URL:** <https://discuss.elastic.co/t/logstash-updating-not-working/163859>\
**Category:** Logstash\
**Created:** [January 11, 2019, 8:13am UTC](https://discuss.elastic.co/t/logstash-updating-not-working/163859 "2019-01-11T08:13:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![inandi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inandi/32/40801_2.png) [@inandi](https://discuss.elastic.co/u/inandi)\
**Post date:** [January 11, 2019, 8:13am UTC](https://discuss.elastic.co/t/logstash-updating-not-working/163859/1 "2019-01-11T08:13:43Z")

</div>

this is logstash.conf file

```
input {
  file {
    path => "/var/www/html/review/EsData/review_data.json"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    codec => "json"        
  }
}

filter { 
}

output {
  if [reviewId] != "" {
    stdout { codec => rubydebug }
    elasticsearch {
      hosts => ["http://localhost:9200/"] 
      index => "review_location_gobinda_26"
      document_id => "%{reviewId}"
    }
  }
}

```

review\_data.json file

```
[{"reviewId":"first data"}]

```

i am running the service using this command

> sudo /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/review.conf

and keeping this service on if i change that json file (review\_data.json file ) like this

```
[{"reviewId":"second data"}]

```

I am getting this kind of error msg

```
[ERROR] 2019-01-11 13:31:12.687 [[main]<file] json - JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected close marker '}': expected ']' (for root starting at [Source: (String)"}]"; line: 1, column: 0])
 at [Source: (String)"}]"; line: 1, column: 2]>, :data=>"}]"}
{
       "message" => "}]",
          "tags" => [
        [0] "_jsonparsefailure"
    ],
    "@timestamp" => 2019-01-11T08:01:12.689Z,
      "@version" => "1",
          "host" => "skills34-Lenovo-ideapad-330-15IKB",
          "path" => "/var/www/html/review/EsData/review_data.json"
}

```

when I run the service with data there is no issue but while updating why this error is coming. not able to understand. Need help.

thanks in advance

@inandi

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 11, 2019, 8:19am UTC](https://discuss.elastic.co/t/logstash-updating-not-working/163859/2 "2019-01-11T08:19:45Z")

</div>

The file input is like tail. If you have a file that contains

```
[{"reviewId":"first data"}]

```

(27 characters) and you change it to contain

```
[{"reviewId":"second data"}]

```

(28 characters) then it will only consume the last character. It looks like it is actually consuming the last two characters of the file, which may indicate you have an extra space in the file.

If, however, you append that second line to the file then it should work OK.

---

<div class="post-metadata">

**Author:** ![inandi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inandi/32/40801_2.png) [@inandi](https://discuss.elastic.co/u/inandi)\
**Post date:** [January 11, 2019, 8:26am UTC](https://discuss.elastic.co/t/logstash-updating-not-working/163859/3 "2019-01-11T08:26:57Z")

</div>

what should be the logstash conf setting? is it correct?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2019, 8:26am UTC](https://discuss.elastic.co/t/logstash-updating-not-working/163859/4 "2019-02-08T08:26:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.