# Need help to parse JSON event

**URL:** <https://discuss.elastic.co/t/need-help-to-parse-json-event/113422>\
**Category:** Logstash\
**Created:** [December 28, 2017, 9:13am UTC](https://discuss.elastic.co/t/need-help-to-parse-json-event/113422 "2017-12-28T09:13:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![siddarth.talupula](https://avatars.discourse-cdn.com/v4/letter/s/a6a055/32.png) [@siddarth.talupula](https://discuss.elastic.co/u/siddarth.talupula)\
**Post date:** [December 28, 2017, 9:13am UTC](https://discuss.elastic.co/t/need-help-to-parse-json-event/113422/1 "2017-12-28T09:13:36Z")

</div>

Hi All,

My application event log contains events in this format:

**12/20/2017 11:08:50 AM - ProlexicService - DEBUG - new value added to event array : {**  
\*\* "eventEndTime": 1513701199,\*\*  
\*\* "eventInfo": {\*\*  
\*\* "attackId": "01fbm--159.50.252.79:gaz\_au:WARN:1513701120:fbm2.3",\*\*  
\*\* "lastOccurred": 1513701199\*\*  
\*\* },\*\*  
\*\* "eventStartTime": 1513701120,\*\*  
\*\* "eventTitle": "Traffic Anomaly Detected for gaz\_au, destination\_ip 159.50.252.79 with top talker DRAFT\_AU",\*\*  
\*\* "eventType": "alert",\*\*  
\*\* "isOngoing": false,\*\*  
\*\* "service": "fbm",\*\*  
\*\* "severity": 60\*\*  
**}**  
**12/20/2017 11:08:50 AM - ProlexicService - DEBUG - new value added to event array : {**  
\*\* "eventEndTime": 1513763354,\*\*  
\*\* "eventInfo": {\*\*  
\*\* "attackId": "01flm--217.163.58.195:bnp\_fr:WARN:1513762440:flm2.3",\*\*  
\*\* "lastOccurred": 1513763354\*\*  
\*\* },\*\*  
\*\* "eventStartTime": 1513762440,\*\*  
\*\* "eventTitle": "Traffic Anomaly Detected for gaz\_au, destination\_ip 207.163.58.165 with top talker Leozeme\_Networks\_Inc.",\*\*  
\*\* "eventType": "alert",\*\*  
\*\* "isOngoing": false,\*\*  
\*\* "service": "fbm",\*\*  
\*\* "severity": 60\*\*  
**}**

I wrote this code in parser file to parse this type of event

**File**  
**do.unparsed.events=true**

**trigger.node.location= /**

**regex=^.+?{s+"eventEndTime":\s(\d+),\n\s+.+\n\s+.+\n\s+.+\n.+\n\s+"eventStartTime":\s(\d+),\n\s+"eventTitle":\s"(.+?),\sdestination\_ip\s(\d+.\d+.\d+.\d+)\s(.+?)",\n\s+"eventType":\s"(\w+)",\n\s+"isOngoing":\s(\w+),\n\s+"service":\s"(\w+)",\n\s+"severity":\s(\d+)\n}**

**token.count=9**

**token[0].name=endTime**  
**token[0].type=TimeStamp**  
**token[0].location=end\_time**

**token[1].name=startTime**  
**token[1].type=TimeStamp**  
**token[1].location=start\_time**

**token[2].name=name**  
**token[2].type=String**  
**token[2].location=name**

**token[3].name=sourceAddress**  
**token[3].type=String**  
**token[3].location=source\_address**

**token[4].name=message**  
**token[4].type=String**  
**token[4].location=message**

**token[5].name=deviceEventCategory**  
**token[5].type=String**  
**token[5].location=device\_event\_category**

**token[6].name=deviceCustomString1**  
**token[6].type=String**  
**token[6].location=device\_custom\_string\_1**

**token[7].name=deviceCustomString2**  
**token[7].type=String**  
**token[7].location=device\_custom\_string\_2**

**token[8].name=deviceSeverity**  
**token[8].type=String**  
**token[8].location=device\_severity**

**#submessage.messageid.token=**

**#submessage.token=**

**event.endTime=endTime**  
**event.startTime=startTime**

**event.name=name**  
**event.sourceAddress=sourceAddress**  
**event.message=message**  
**event.deviceEventCategory=deviceEventCategory**  
**event.deviceCustomString1=deviceCustomString1**  
**event.deviceCustomString2=deviceCustomString2**  
**event.deviceSeverity=deviceSeverity**

**event.deviceProduct=\_\_stringConstant("Prolexic")**  
**event.deviceProduct=\_\_stringConstant("Akamai")**

**#l10n.filename.prefix=**

I am getting this error;

**INFO | jvm 1 | 2017/12/27 16:32:40 | FATAL EXCEPTION:INFO | jvm 1 | 2017/12/27 16:32:40 | java.lang.RuntimeException: Unexpected character ('/' (code 47)): Expected space separating root-level valuesINFO | jvm 1 | 2017/12/27 16:32:40 | at [Source: java.io.FileInputStream@1542b62f; line: 1, column: 4]**

Is something wrong with my code?

Please help.

Thanks,

Siddarth

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 31, 2017, 1:24pm UTC](https://discuss.elastic.co/t/need-help-to-parse-json-event/113422/2 "2017-12-31T13:24:35Z")

</div>

Please don't post the same question multiple times. You got a response in the other post; please follow up there.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 28, 2018, 1:24pm UTC](https://discuss.elastic.co/t/need-help-to-parse-json-event/113422/3 "2018-01-28T13:24:43Z")

</div>

Closed on January 28, 2018, 1:24pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.