Logstash write to json no comma separator

Hello everyone.
I am saving my logstash events to a json file as follow:

 file {
    path => "path\event-%{+yyyy.MM.dd}.json"
    codec => json

everything is fine, until today that I realised that the file is not formatted correctly.
basically what is happening, is just writing line by line the events without wrapping them in [ ] or inserting any comma between the event. this is the output I am having in my json file

"{"sourceUserName":"value","@timestamp":"2021-08-03T00:37:09.180Z","name":"value","deviceAction":"value","userID":"value"}
{"sourceUserName":"value","@timestamp":"2021-08-03T00:39:13.445Z","name":"value","deviceAction":"value","userID":"value"}
{"

Is there any solution of I could have the json parsed correctly please?

An output processes each event independently of the others. A json codec outputs an event as a string of JSON. If you want to append a comma to the string you would have to encode the event into JSON yourself and then use a plain or line codec with a format option. I cannot think of a way to format the output as an array.

Thank you very much for your reply one more time.
I have been looking into logstash documentations, and I cannot find much about this.

The only thing I could find is about this?

 file {
    codec => line {format => ","}

The file output, by default is a json file, which is perfect. and according to the documentation, we can customise the output using the format, which is great. Running that configuration, it works but it does not add the comma at the end of each event, but add one for each event at the end of the file.

But that's it, there is nothing regarding this.

You have more experience than me on this, maybe I am missing some documentation about this or how this file codec works?

Thank you so much for any clarification

You could try

filter {
    ruby { code => 'event.set("[@metadata][json]", event.to_hash.to_s)' }
}
output { stdout { codec => line { format => "%{[@metadata][json]}," } } }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.