# Logstash updating the data not working

**URL:** <https://discuss.elastic.co/t/logstash-updating-the-data-not-working/163862>\
**Category:** Logstash\
**Created:** [January 11, 2019, 8:15am UTC](https://discuss.elastic.co/t/logstash-updating-the-data-not-working/163862 "2019-01-11T08:15:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![inandi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inandi/32/40801_2.png) [@inandi](https://discuss.elastic.co/u/inandi)\
**Post date:** [January 11, 2019, 8:15am UTC](https://discuss.elastic.co/t/logstash-updating-the-data-not-working/163862/1 "2019-01-11T08:15:25Z")

</div>

logstash.conf file

```
input {
  file {
    path => "/var/www/html/review/EsData/review_data.json"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    codec => "json"        
  }
}

filter { 
}

output {
  if [reviewId] != "" {
    stdout { codec => rubydebug }
    elasticsearch {
      hosts => ["http://localhost:9200/"] 
      index => "review_location_gobinda_26"
      document_id => "%{reviewId}"
    }
  }
}

```

review\_data.json file

```
[{"reviewId":"first data"}]

```

i am running the service using this command

> sudo /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/review.conf

and keeping this service on if i change that json file (review\_data.json file ) like this

```
[{"reviewId":"second data"}]

```

I am getting this kind of error msg

```
[ERROR] 2019-01-11 13:31:12.687 [[main]<file] json - JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected close marker '}': expected ']' (for root starting at [Source: (String)"}]"; line: 1, column: 0])
 at [Source: (String)"}]"; line: 1, column: 2]>, :data=>"}]"}
{
       "message" => "}]",
          "tags" => [
        [0] "_jsonparsefailure"
    ],
    "@timestamp" => 2019-01-11T08:01:12.689Z,
      "@version" => "1",
          "host" => "skills34-Lenovo-ideapad-330-15IKB",
          "path" => "/var/www/html/review/EsData/review_data.json"
}

```

when I run the service with data there is no issue but while updating why this error is coming. not able to understand. Need help.

thanks in advance

@inandi

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [January 11, 2019, 8:26am UTC](https://discuss.elastic.co/t/logstash-updating-the-data-not-working/163862/2 "2019-01-11T08:26:14Z")

</div>

Hi @inandi,

I would usually test if my answer works before I answer but I don't really have time for that right now, so this is an unverified suggestion.

As far as I know, Logstash expects one JSON object per line. You gave it an _array_. Please try without the square brackets.

---

<div class="post-metadata">

**Author:** ![inandi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inandi/32/40801_2.png) [@inandi](https://discuss.elastic.co/u/inandi)\
**Post date:** [January 11, 2019, 8:42am UTC](https://discuss.elastic.co/t/logstash-updating-the-data-not-working/163862/3 "2019-01-11T08:42:42Z")

</div>

THANKS MAN i did it

@A_B

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2019, 8:42am UTC](https://discuss.elastic.co/t/logstash-updating-the-data-not-working/163862/4 "2019-02-08T08:42:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.