Nested json imposible to parse

(Fernando Martinez) #1


I have a nested json in a field like this:
"host" => "",
"source" => "/mnt/centralizedlogs/logstash/netsec/48851f14d3e9/2017-06-08.txt",
"message" => "{"@timestamp"=>"2017-06-08T07:06:13.427Z", "@version"=>"1", "beat"=>{"hostname"=>"48851f14d3e9", "name"=>"48851f14d3e9", "version"=>"5.4.1"}, "group"=>"netsec", "host"=>"48851f14d3e9", "identifier"=>"asalog", "input_type"=>"log", "message"=>"Jun 8 02:06:12 %ASA-4-106023: Deny tcp src OUTSIDE: dst ProdWeb: by access-group \"101\" [0x0, 0x0]", "offset"=>44112925, "source"=>"/var/log/asa/asa.log", "tags"=><Java::JavaUtil::ArrayList:-1276964729 ["beats_input_codec_plain_applied"]>, "type"=>"log"}",
I tried to do:

source => "message"
target => "parsed"
also tried to add_field with:


not working :frowning:

Also in the input i tried:

codec => "json"

Always I get a : [0] "_jsonparsefailure",

any ideas? what I'm doing wrong?

Thank you very much!

(Fernando Martinez) #2

I get: <LogStash::Json::ParserError: Unexpected character ('=' (code 61)): was expecting a colon to separate field name and value

I guess I have to replace "=" for ":"...


(Magnus Bäck) #3

What you've shown us isn't JSON. It looks like something produced by Logstash's rubydebug codec. If so, why are you trying to parse it?

(Fernando Martinez) #4


this is what i receive from filebeat which i'm not the owner...

(Christian Dahlqvist) #5

Even though that is not valid JSON, it is quite close, so you may be able to convert it to valid JSON using a mutate filter. Something like this may work:

mutate {
    gsub => [
      "message", '=>', ':',
      "message", ':,', ':[],'

(Magnus Bäck) #6

Well, Filebeat doesn't produce data that looks like that. Where does Filebeat get its data from?

(Fernando Martinez) #7


maybe the problem comes from the origin, I don't know.., But I will use the Christian solution, to get a valid JSON


(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.