# Logstash with Grok and \_jsonparsefailure

**URL:** <https://discuss.elastic.co/t/logstash-with-grok-and--jsonparsefailure/63719>\
**Category:** Logstash\
**Created:** [October 24, 2016, 8:40am UTC](https://discuss.elastic.co/t/logstash-with-grok-and--jsonparsefailure/63719 "2016-10-24T08:40:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Guillermo\_Ortiz](https://avatars.discourse-cdn.com/v4/letter/g/258eb7/32.png) [@Guillermo\_Ortiz](https://discuss.elastic.co/u/Guillermo_Ortiz)\
**Post date:** [October 24, 2016, 8:40am UTC](https://discuss.elastic.co/t/logstash-with-grok-and--jsonparsefailure/63719/1 "2016-10-24T08:40:21Z")

</div>

I'm trying to parse the access log from NGINX with Logstash but, I get an **\_jsonparsefailure** although I'm not using a JSON format. Why do I get that \_jsonparsefailure?

My input lines are like  
_nginx: 127.0.0.1 - - [24/Oct/2016:10:34:59 +0200] "GET /app/kibana HTTP/1.1" 200 5018 "-" "curl/7.19.7 (x86\_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.18 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2"`_

My config file in Logstash is:

```
input {
        kafka {
                 topic_id => "access-log-nginx"
                 zk_connect => "xxx:2181"
                 consumer_threads => 4
        }
}
filter {
        grok{
                match=>{
                        "message"=>"%{WORD:nginx}\: %{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"
                }
        }
        mutate {
                convert => ["response", "integer"]
                convert => ["bytes", "integer"]
                convert => ["responsetime", "float"]
        }

        geoip {
                source => "clientip"
                target => "geoip"
                add_tag => ["nginx-geoip"]
        }
}
output {
        stdout { codec => rubydebug }
        elasticsearch {
                hosts => ["xxx:9200"]
                user => "spark-user"
                password => "spark-us3r"
                index => "access_log_%{+YYYY.MM.dd}"
         }
}

```

The output from logstash:

```
{
        "message" => "nginx: 127.0.0.1 - - [24/Oct/2016:10:34:59 +0200] \"GET /app/kibana HTTP/1.1\" 200 5018 \"-\" \"curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.18 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2\"",
           "tags" => [
        **[0] "_jsonparsefailure"**
    ],
       "@version" => "1",
     "@timestamp" => "2016-10-24T08:35:05.488Z",
          "nginx" => "nginx",
       "clientip" => "127.0.0.1",
          "ident" => "-",
           "auth" => "-",
      "timestamp" => "24/Oct/2016:10:34:59 +0200",
           "verb" => "GET",
        "request" => "/app/kibana",
    "httpversion" => "1.1",
       "response" => 200,
          "bytes" => 5018,
       "referrer" => "\"-\"",
          "agent" => "\"curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.18 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2\""
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 26, 2016, 6:01am UTC](https://discuss.elastic.co/t/logstash-with-grok-and--jsonparsefailure/63719/2 "2016-10-26T06:01:15Z")

</div>

The kafka input's default codec is json. In your case you need to explicitly configure it to use the plain codec.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:32am UTC](https://discuss.elastic.co/t/logstash-with-grok-and--jsonparsefailure/63719/3 "2017-07-06T04:32:47Z")

</div>