logstash.conf file
input {
file {
path => "/var/www/html/review/EsData/review_data.json"
start_position => "beginning"
sincedb_path => "/dev/null"
codec => "json"
}
}
filter {
}
output {
if [reviewId] != "" {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["http://localhost:9200/"]
index => "review_location_gobinda_26"
document_id => "%{reviewId}"
}
}
}
review_data.json file
[{"reviewId":"first data"}]
i am running the service using this command
sudo /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/review.conf
and keeping this service on if i change that json file (review_data.json file ) like this
[{"reviewId":"second data"}]
I am getting this kind of error msg
[ERROR] 2019-01-11 13:31:12.687 [[main]<file] json - JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected close marker '}': expected ']' (for root starting at [Source: (String)"}]"; line: 1, column: 0])
at [Source: (String)"}]"; line: 1, column: 2]>, :data=>"}]"}
{
"message" => "}]",
"tags" => [
[0] "_jsonparsefailure"
],
"@timestamp" => 2019-01-11T08:01:12.689Z,
"@version" => "1",
"host" => "skills34-Lenovo-ideapad-330-15IKB",
"path" => "/var/www/html/review/EsData/review_data.json"
}
when I run the service with data there is no issue but while updating why this error is coming. not able to understand. Need help.
thanks in advance