# Parse JSON string contained in a Syslog message **URL:** \ **Category:** Logstash\ **Created:** [July 7, 2016, 1:50pm UTC](https://discuss.elastic.co/t/parse-json-string-contained-in-a-syslog-message/54951 "2016-07-07T13:50:57Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![norandom](https://avatars.discourse-cdn.com/v4/letter/n/d07c76/32.png) [@norandom](https://discuss.elastic.co/u/norandom)\ **Post date:** [July 7, 2016, 1:50pm UTC](https://discuss.elastic.co/t/parse-json-string-contained-in-a-syslog-message/54951/1 "2016-07-07T13:50:57Z")
Hi, I have a program which sends its JSON data via Syslog. Example: `Jul 7 14:17:48 10.1.1.221 suricata[28230]: {"timestamp":"2016-07-07T14:19:52.081015+0000",..."}` ``` input { file { type => "syslog" path => [ "/var/log/foo/suricata.log" ] } } filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGBASE} %{GREEDYDATA:syslog_message}" } } json { source => { source => "syslog_message" } } } } output { elasticsearch { hosts => ["search-bar.es.amazonaws.com:80"] } } ``` This yields a strange error: > ``` > java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+HeapDumpOnOutOfMemoryError -Djava.io.tmpdir=/var/lib/logstash -Xmx1g -Xss2048k -Djffi.boot.library.path=/opt/logstash/vendor/jruby/lib/jni -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+HeapDumpOnOutOfMemoryError -Djava.io.tmpdir=/var/lib/logstash -XX:HeapDumpPath=/opt/logstash/heapdump.hprof -Xbootclasspath/a:/opt/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/opt/logstash/vendor/jruby -Djruby.lib=/opt/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main --1.9 /opt/logstash/lib/bootstrap/environment.rb logstash/runner.rb agent -f /etc/logstash/conf.d > > ``` ``` Settings: Default pipeline workers: 4 Logstash startup completed Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#, "backtrace"=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.2.4-java/lib/logstash/event.rb:117:in `[]'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-json-2.0.6/lib/logstash/filters/json.rb:69:in `filter'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/filters/base.rb:151:in `multi_filter'", "org/jruby/RubyArray.java:1613:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/filters/base.rb:148:in `multi_filter'", "(eval):83:in `cond_func_1'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):79:in `cond_func_1'", "(eval):66:in `filter_func'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:259:in `filter_batch'", "org/jruby/RubyArray.java:1613:in `each'", "org/jruby/RubyEnumerable.java:852:in `inject'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:257:in `filter_batch'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:215:in `worker_loop'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:193:in `start_workers'"], :level=>:error} NoMethodError: undefined method `start_with?' for ["source", "syslog_message"]:Array [] at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.2.4-java/lib/logstash/event.rb:117 filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-json-2.0.6/lib/logstash/filters/json.rb:69 multi_filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/filters/base.rb:151 each at org/jruby/RubyArray.java:1613 multi_filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/filters/base.rb:148 cond_func_1 at (eval):83 each at org/jruby/RubyArray.java:1613 cond_func_1 at (eval):79 filter_func at (eval):66 filter_batch at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:259 each at org/jruby/RubyArray.java:1613 inject at org/jruby/RubyEnumerable.java:852 filter_batch at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:257 worker_loop at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:215 start_workers at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:193 ``` Does anyone know what the problem is? ---
**Author:** ![marke72](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marke72/32/10832_2.png) [@marke72](https://discuss.elastic.co/u/marke72)\ **Post date:** [July 7, 2016, 2:34pm UTC](https://discuss.elastic.co/t/parse-json-string-contained-in-a-syslog-message/54951/2 "2016-07-07T14:34:38Z")
Your `json` filter is incorrect. It should be `json { source => "syslog_message" }`. Not sure if that's the problem though. Reference [https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html#plugins-filters-json-source](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html#plugins-filters-json-source) ---
**Author:** ![norandom](https://avatars.discourse-cdn.com/v4/letter/n/d07c76/32.png) [@norandom](https://discuss.elastic.co/u/norandom)\ **Post date:** [July 7, 2016, 2:57pm UTC](https://discuss.elastic.co/t/parse-json-string-contained-in-a-syslog-message/54951/3 "2016-07-07T14:57:07Z")
That was the issue. Thank you 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/parse-json-string-contained-in-a-syslog-message/54951/4 "2017-07-06T04:49:06Z")