Logstash updating the data not working

logstash.conf file

input {
  file {
    path => "/var/www/html/review/EsData/review_data.json"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    codec => "json"        

filter { 

output {
  if [reviewId] != "" {
    stdout { codec => rubydebug }
    elasticsearch {
      hosts => ["http://localhost:9200/"] 
      index => "review_location_gobinda_26"
      document_id => "%{reviewId}"

review_data.json file

[{"reviewId":"first data"}]

i am running the service using this command

sudo /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/review.conf

and keeping this service on if i change that json file (review_data.json file ) like this

[{"reviewId":"second data"}]

I am getting this kind of error msg

[ERROR] 2019-01-11 13:31:12.687 [[main]<file] json - JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected close marker '}': expected ']' (for root starting at [Source: (String)"}]"; line: 1, column: 0])
 at [Source: (String)"}]"; line: 1, column: 2]>, :data=>"}]"}
       "message" => "}]",
          "tags" => [
        [0] "_jsonparsefailure"
    "@timestamp" => 2019-01-11T08:01:12.689Z,
      "@version" => "1",
          "host" => "skills34-Lenovo-ideapad-330-15IKB",
          "path" => "/var/www/html/review/EsData/review_data.json"

when I run the service with data there is no issue but while updating why this error is coming. not able to understand. Need help.

thanks in advance


Hi @inandi,

I would usually test if my answer works before I answer but I don't really have time for that right now, so this is an unverified suggestion.

As far as I know, Logstash expects one JSON object per line. You gave it an array. Please try without the square brackets.

1 Like

THANKS MAN i did it


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.