# Moving from JSON to non-JSON input filter

**URL:** <https://discuss.elastic.co/t/moving-from-json-to-non-json-input-filter/77159>\
**Category:** Logstash\
**Created:** [March 2, 2017, 3:09pm UTC](https://discuss.elastic.co/t/moving-from-json-to-non-json-input-filter/77159 "2017-03-02T15:09:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\
**Post date:** [March 2, 2017, 3:09pm UTC](https://discuss.elastic.co/t/moving-from-json-to-non-json-input-filter/77159/1 "2017-03-02T15:09:57Z")

</div>

I've been sending our application logs via UDP wrapped in a JSON format, so the log looks something like this

```
{
  "key1" : "value1",
  "key2" : "value2",
  "message" : "2017-03-02 INFO com.company.app Hello world!"
}

```

and my Logstash input filter looks like tis

```
input {
  udp {
    port => 1234
    codec => json
  }
}

```

However Logstash gives me \_jsonparsefailure when the message contains a long stack dump or an XML file. (See [Help with \_jsonparsefailure](https://discuss.elastic.co/t/help-with--jsonparsefailure/76446/4))

So I want to try sending my logs in a non-JSON format, and I have two questions.

**Question 1:**

Should I send them like this, i.e., single line

`key1: value1 key2: value2 message: 2017-03-02 INFO com.company.app Hello world!`

...or should I send them like this, that is, multi-lines

`key1: value1 key2: value2 message: 2017-03-02 INFO com.company.app Hello world!`

**Question 2:**  
In either case, how should my input filter look like so I can separate logs from each other?

This is the main reason I wrapped the logs in JSON in the first place since they were naturally separated.

I hope that makes sense. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 30, 2017, 3:10pm UTC](https://discuss.elastic.co/t/moving-from-json-to-non-json-input-filter/77159/2 "2017-03-30T15:10:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.