# Multiline JSON file not ingested with logstash to ElasticSearch
**URL:** https://discuss.elastic.co/t/multiline-json-file-not-ingested-with-logstash-to-elasticsearch/177144
**Category:** Logstash
**Created:** [April 16, 2019, 7:19pm UTC](https://discuss.elastic.co/t/multiline-json-file-not-ingested-with-logstash-to-elasticsearch/177144 "2019-04-16T19:19:40Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@releaseblocker](https://discuss.elastic.co/u/releaseblocker)
#### Post date: [April 16, 2019, 7:19pm UTC](https://discuss.elastic.co/t/multiline-json-file-not-ingested-with-logstash-to-elasticsearch/177144/1 "2019-04-16T19:19:40Z")
I have a logstash config file as
input{
file {
type =\> "json"
path =\> "/home/$user/MOCK\_DATA.json"
start\_position =\> "beginning"
codec =\> multiline
{
pattern =\> '^{'
what =\> previous
}
}
}
output{
elasticsearch {
hosts =\> ["localhost:9200"]
}
stdout { codec =\> rubydebug }
}
The logstash starts and keeps printing below
[2019-04-17T00:48:16,622][DEBUG][logstash.outputs.stdout] config LogStash::Outputs::Stdout/@id = "7987e564e4590724503a51b0f02cf750dbde09f3-6"
[2019-04-17T00:48:16,622][DEBUG][logstash.outputs.stdout] config LogStash::Outputs::Stdout/@enable\_metric = true
[2019-04-17T00:48:16,622][DEBUG][logstash.outputs.stdout] config LogStash::Outputs::Stdout/@workers = 1
[2019-04-17T00:48:16,628][DEBUG][logstash.agent] starting agent
[2019-04-17T00:48:16,632][DEBUG][logstash.agent] starting pipeline {:id=\>"main"}
[2019-04-17T00:48:16,636][DEBUG][logstash.filters.csv] CSV parsing options {:col\_sep=\>",", :quote\_char=\>"""}
[2019-04-17T00:48:16,639][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>8, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>1000}
[2019-04-17T00:48:16,826][INFO][logstash.pipeline] Pipeline main started
[2019-04-17T00:48:16,830][DEBUG][logstash.inputs.file] \_globbed\_files: /home/MOCK\_DATA.json"]
[2019-04-17T00:48:16,830][DEBUG][logstash.inputs.file] \_discover\_file: /home/MOCK\_DATA.json (exclude is )
[2019-04-17T00:48:16,831][DEBUG][logstash.inputs.file] \_open\_file: /home/MOCK\_DATA.json: opening
[2019-04-17T00:48:16,832][DEBUG][logstash.inputs.file] /home/MOCK\_DATA.json: sincedb last value 143901, cur size 143901
[2019-04-17T00:48:16,832][DEBUG][logstash.inputs.file] /home/MOCK\_DATA.json: sincedb: seeking to 143901
[2019-04-17T00:48:16,837][DEBUG][logstash.agent] Starting puma
[2019-04-17T00:48:16,838][DEBUG][logstash.agent] Trying to start WebServer {:port=\>9600}
[2019-04-17T00:48:16,840][DEBUG][logstash.api.service] [api-service] start
[2019-04-17T00:48:16,890][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
[2019-04-17T00:48:20,963][DEBUG][logstash.instrument.periodicpoller.cgroup] One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu
[2019-04-17T00:48:21,832][DEBUG][logstash.pipeline] Pushing flush onto pipeline
[2019-04-17T00:48:25,969][DEBUG][logstash.instrument.periodicpoller.cgroup] One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu
[2019-04-17T00:48:26,834][DEBUG][logstash.pipeline] Pushing flush onto pipeline
[2019-04-17T00:48:30,887][DEBUG][logstash.inputs.file] \_globbed\_files: /home/MOCK\_DATA.json"]
[2019-04-17T00:48:30,973][DEBUG][logstash.instrument.periodicpoller.cgroup] One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu
JSOn file has below content
[
{"employee\_id":780,"first\_name":"Zuzana","last\_name":"Ames","email":"zamesln@jugem.jp","gender":"Female","ip\_address":"84.193.133.88"},
{"employee\_id":781,"first\_name":"Emilee","last\_name":"Glavias","email":"eglaviaslo@omniture.com","gender":"Female","ip\_address":"100.119.249.85"},
{"employee\_id":782,"first\_name":"Ford","last\_name":"De [Robertis","email":"fderobertislp@wikispaces.com](mailto:Robertis%22,%22email%22:%22fderobertislp@wikispaces.com)","gender":"Male","ip\_address":"159.81.140.145"}
]
There is no data in Elastic search . Can someone help on what's wrong here ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 16, 2019, 8:03pm UTC](https://discuss.elastic.co/t/multiline-json-file-not-ingested-with-logstash-to-elasticsearch/177144/2 "2019-04-16T20:03:49Z")
```auto
[2019-04-17T00:48:16,831][DEBUG][logstash.inputs.file] _open_file: /home/MOCK_DATA.json: opening
[2019-04-17T00:48:16,832][DEBUG][logstash.inputs.file] /home/MOCK_DATA.json: sincedb last value 143901, cur size 143901
[2019-04-17T00:48:16,832][DEBUG][logstash.inputs.file] /home/MOCK_DATA.json: sincedb: seeking to 143901
```
logstash has already read the file, so it skips to the end of the file and waits for data to be appended to it. If you want to force logstash to re-read it you can set
```
sincedb_path => "/dev/null"
```
The way you have configured the multiline you will get JSON arrays that are missing the final ']' followed by a separate event that contains the ']'. You can drop the latter using
```
if [message] == "]" { drop {} }
```
If you want to parse the json then use
```
mutate { gsub => ["message", "\Z", "]" ] }
json { source => "message" target => "someField" }
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 14, 2019, 8:03pm UTC](https://discuss.elastic.co/t/multiline-json-file-not-ingested-with-logstash-to-elasticsearch/177144/3 "2019-05-14T20:03:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.