Multiple Nested JSON Parse

Elastic Stack Logstash
1

Hi... i'm having issue with parsing of multiple nested JSON can any1 help..
I just dont want identify key field..

JSON Format

{
"billingDetails": {
"POSBILL": [
{
"BillId": 49,
"BillNo": "POS/16Oct18",
"BillDate": "2018-10-12T17:29:03.053",
"TerminalId": "2",
"customerId": "",
"cardNo": "",
"StockPointId": "1",
"DiscountId": "",
"MRPAmt": "2000.00",
"BasicAmt": "2000.00",
"PromoAmt": "0",
"SaleAmt": "2000.00",
"ReturnAmt": "0",
"GrossAmt": "2000.00",
"LPDiscountAmt": "0",
"discountBenefitId": "",
"pointBenefit": "",
"DiscountAmt": "0.00",
"NetAmt": "2000.00",
"ChargeAmt": "0",
"NetPayable": "2000",
"RoundOff": "0",
"ExTaxAmt": "0",
"PromoCode": "",
"PromoBenefit": "",
"BillGUID": "3-2-121018172710",
"MDiscountAmt": "0",
"EMRREDCouponRef": "",
"CouponCode": ""
}
],
"POSBillItems": [
{
"POSBillItemId": 170,
"ItemId": "T1036",
"BarCode": "1",
"ItemName": "SKIRT",
"Division": "Gents",
"Section": "Upper",
"Department": "Shirt",
"Article": "GENTS-UPPER-SHIRT",
"Qty": 1,
"RtQty": 0,
"MRP": 1000,
"RSP": 1000,
"ESP": 1000,
"MRPAmt": 1000,
"BasicAmt": 1000,
"PromoAmt": 0,
"GrossAmt": 1000,
"IDiscountDisplay": null,
"IDiscountAmt": 0,
"SalePrice": 1000,
"IGrossAmt": 1000,
"MDiscountAmt": 0,
"DiscountAmt": 0,
"NetAmt": 1000,
"TaxPercent": 5,
"TaxAmt": 47.62,
"TaxableAmt": 952.38,
"IDiscountFactor": 0,
"MDiscountFactor": 0,
"PromoCode": null,
"PromoDiscountFactor": null,
"RefPOSBillItemId": null,
"LPDiscountBenefit": null,
"LPPointBenefit": null,
"MGrossAmt": 1000,
"LPDiscountAmt": null,
"LPAmountSpendFactor": null,
"LPPointEarnedFactor": null,
"LPPointsCalculated": 0,
"LPDiscountFactor": null,
"RefBillNo": null
},
{
"POSBillItemId": 171,
"ItemId": "T1036",
"BarCode": "1",
"ItemName": "SKIRT",
"Division": "Gents",
"Section": "Upper",
"Department": "Shirt",
"Article": "GENTS-UPPER-SHIRT",
"Qty": 1,
"RtQty": 0,
"MRP": 1000,
"RSP": 1000,
"ESP": 1000,
"MRPAmt": 1000,
"BasicAmt": 1000,
"PromoAmt": 0,
"GrossAmt": 1000,
"IDiscountDisplay": null,
"IDiscountAmt": 0,
"SalePrice": 1000,
"IGrossAmt": 1000,
"MDiscountAmt": 0,
"DiscountAmt": 0,
"NetAmt": 1000,
"TaxPercent": 5,
"TaxAmt": 47.62,
"TaxableAmt": 952.38,
"IDiscountFactor": 0,
"MDiscountFactor": 0,
"PromoCode": null,
"PromoDiscountFactor": null,
"RefPOSBillItemId": null,
"LPDiscountBenefit": null,
"LPPointBenefit": null,
"MGrossAmt": 1000,
"LPDiscountAmt": null,
"LPAmountSpendFactor": null,
"LPPointEarnedFactor": null,
"LPPointsCalculated": 0,
"LPDiscountFactor": null,
"RefBillNo": null
}
],
"POSBillMOP": [
{
"POSBillMOPId": 93,
"MOPId": "112",
"MOPName": "Cash",
"MOPType": "CSH",
"CurrencyId": "1",
"BaseTender": 2000,
"BaseBalance": 0,
"BaseAmt": 2000,
"Tender": 2000,
"CCNo": null
}
],
"POSCustomer": []
},
"membershipId": null,
"BillEvent": "NEW",
"event": "addTransaction",
"apiTypeResolver": "api",
"providerCode": "LPCAP",
"metadata": {
"enterpriseMetadata": {
"enterpriseId": "5a3229d5ccbc37c3449a4890",
"cluster": "api.capillary.co.in",
"apiversion": "v1.1",
"pointredemptionview_otpvalidation": "0",
"couponredemptionview_otpvalidation": "0"
},
"storeMetadata": {
"password": "and123",
"username": "and.ho1",
"storeCode": "3"
},
"requestMetadata": {
"requestUid": "c7bdad7e-3361-41a3-8ff6-d9db93b414b2",
"mqReferenceNo": "8c7c54e9-f428-4761-9c65-f6bb86f5df3a"
}
}
}

My conf file...

input {
s3 {
access_key_id => ""
secret_access_key => ""
region => ""
bucket => ""
interval => 30
additional_settings => {
force_path_style => true
follow_redirects => false
}
codec => multiline {
pattern => "^\s"
what => "previous"
}
}
}
filter {
grok {
match => {"message" => "%{TIME:Time}%{SPACE}[%{DATA:thread}]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}%{JAVACLASS:log-class}%{SPACE}-%{SPACE}%{DATA:requestType}%{SPACE}{%{QS:id}:%{NUMBER:id},(?:.):%{QS:requestId},(?:.):%{QS:messageReferenceNo},(?:.):%{QS:retailModule},(?:.):%{QS:event},(?:.):%{QS:enterpriseId},(?:.):%{QS:storeId},(?:.*):%{QS:requestData},%{QS:requestTime}:%{NUMBER:requestTime},%{QS:auditAction}:%{NUMBER:auditAction}}"}

  match => {"message" => "%{TIME:Time}%{SPACE}\[%{DATA:thread}]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}%{JAVACLASS:log-class}%{SPACE}-%{SPACE}%{GREEDYDATA:details}"}
}

}
filter {
mutate {
gsub => [ "requestData", '\"', '"' ]
}
}
filter {
json {
source => "requestData"
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "s3-bucket"
}
stdout {
codec => rubydebug
}
}

Please help...

2

i've used JSON filter but getting this error

Error parsing json {:source=>"requestData", :raw=>""{"billingDetails":{"POSBILL":[{"BillId":49,"BillNo":"POS/16Oct18","BillDate":"2018-10-12T17:29:03.053","TerminalId":"2","customerId":"","cardNo":"","StockPointId":"1","DiscountId":"","MRPAmt":"2000.00","BasicAmt":"2000.00","PromoAmt":"0","SaleAmt":"2000.00","ReturnAmt":"0","GrossAmt":"2000.00","LPDiscountAmt":"0","discountBenefitId":"","pointBenefit":"","DiscountAmt":"0.00","NetAmt":"2000.00","ChargeAmt":"0","NetPayable":"2000","RoundOff":"0","ExTaxAmt":"0","PromoCode":"","PromoBenefit":"","BillGUID":"3-2-121018172710","MDiscountAmt":"0","EMRREDCouponRef":"","CouponCode":""}],"POSBillItems":[{"POSBillItemId":170,"ItemId":"T1036","BarCode":"1","ItemName":"SKIRT","Division":"Gents","Section":"Upper","Department":"Shirt","Article":"GENTS-UPPER-SHIRT","Qty":1.0,"RtQty":0.0,"MRP":1000.0,"RSP":1000.0,"ESP":1000.0,"MRPAmt":1000.0,"BasicAmt":1000.0,"PromoAmt":0.0,"GrossAmt":1000.0,"IDiscountDisplay":null,"IDiscountAmt":0.0,"SalePrice":1000.0,"IGrossAmt":1000.0,"MDiscountAmt":0.0,"DiscountAmt":0.0,"NetAmt":1000.0,"TaxPercent":5.0,"TaxAmt":47.62,"TaxableAmt":952.38,"IDiscountFactor":0.0,"MDiscountFactor":0.0,"PromoCode":null,"PromoDiscountFactor":null,"RefPOSBillItemId":null,"LPDiscountBenefit":null,"LPPointBenefit":null,"MGrossAmt":1000.0,"LPDiscountAmt":null,"LPAmountSpendFactor":null,"LPPointEarnedFactor":null,"LPPointsCalculated":0,"LPDiscountFactor":null,"RefBillNo":null},{"POSBillItemId":171,"ItemId":"T1036","BarCode":"1","ItemName":"SKIRT","Division":"Gents","Section":"Upper","Department":"Shirt","Article":"GENTS-UPPER-SHIRT","Qty":1.0,"RtQty":0.0,"MRP":1000.0,"RSP":1000.0,"ESP":1000.0,"MRPAmt":1000.0,"BasicAmt":1000.0,"PromoAmt":0.0,"GrossAmt":1000.0,"IDiscountDisplay":null,"IDiscountAmt":0.0,"SalePrice":1000.0,"IGrossAmt":1000.0,"MDiscountAmt":0.0,"DiscountAmt":0.0,"NetAmt":1000.0,"TaxPercent":5.0,"TaxAmt":47.62,"TaxableAmt":952.38,"IDiscountFactor":0.0,"MDiscountFactor":0.0,"PromoCode":null,"PromoDiscountFactor":null,"RefPOSBillItemId":null,"LPDiscountBenefit":null,"LPPointBenefit":null,"MGrossAmt":1000.0,"LPDiscountAmt":null,"LPAmountSpendFactor":null,"LPPointEarnedFactor":null,"LPPointsCalculated":0,"LPDiscountFactor":null,"RefBillNo":null}],"POSBillMOP":[{"POSBillMOPId":93,"MOPId":"112","MOPName":"Cash","MOPType":"CSH","CurrencyId":"1","BaseTender":2000.0,"BaseBalance":0.0,"BaseAmt":2000.0,"Tender":2000.0,"CCNo":null}],"POSCustomer":[]},"membershipId":null,"BillEvent":"NEW","event":"addTransaction","apiTypeResolver":"api","providerCode":"LPCAP","metadata":{"enterpriseMetadata":{"enterpriseId":"5a3229d5ccbc37c3449a4890","cluster":"api.capillary.co.in","apiversion":"v1.1","pointredemptionview_otpvalidation":"0","couponredemptionview_otpvalidation":"0"},"storeMetadata":{"password":"and123","username":"and.ho1","storeCode":"3"},"requestMetadata":{"requestUid":"c7bdad7e-3361-41a3-8ff6-d9db93b414b2","mqReferenceNo":"8c7c54e9-f428-4761-9c65-f6bb86f5df3a"}}}"", :exception=>#<LogStash::Json::ParserError: Unrecognized token 'billingDetails': was expecting ('true', 'false' or 'null')
at [Source: (byte[])""{"billingDetails":{"POSBILL":[{"BillId":49,"BillNo":"POS/16Oct18","BillDate":"2018-10-12T17:29:03.053","TerminalId":"2","customerId":"","cardNo":"","StockPointId":"1","DiscountId":"","MRPAmt":"2000.00","BasicAmt":"2000.00","PromoAmt":"0","SaleAmt":"2000.00","ReturnAmt":"0","GrossAmt":"2000.00","LPDiscountAmt":"0","discountBenefitId":"","pointBenefit":"","DiscountAmt":"0.00","NetAmt":"2000.00","ChargeAmt":"0","NetPayable":"2000","RoundOff":"0","ExTaxAmt":"0","PromoCode":"","PromoBenefit":"","Bil"[truncated 2407 bytes]; line: 1, column: 19]>}

3

Solved... i was trying to parse JSON String

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.