# Parse Logstash.log with logstash

**URL:** https://discuss.elastic.co/t/parse-logstash-log-with-logstash/49061
**Category:** Logstash
**Created:** [May 3, 2016, 1:33pm UTC](https://discuss.elastic.co/t/parse-logstash-log-with-logstash/49061 "2016-05-03T13:33:35Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![webofmars](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/webofmars/32/9532_2.png) [@webofmars](https://discuss.elastic.co/u/webofmars)
#### Post date: [May 3, 2016, 1:33pm UTC](https://discuss.elastic.co/t/parse-logstash-log-with-logstash/49061/1 "2016-05-03T13:33:35Z")

</div>

Hello,

That might sounds a bit silly question (or circular one...) but how do you parse logstah.log with logstash itself. I always thought that it was json format but the ':' at the start seems to say that it isn't.

tried

filter {  
json {  
source =\> "message"  
}  
}

and it does produce error :

{:timestamp=\>"2016-05-03T15:19:21.889000+0200", :message=\>"Error parsing json", :source=\>"message", :raw=\>"{:timestamp=\>"2016-05-03T14:12:18.094000+0200", :message=\>"SIGTERM received. Shutting down the pipeline.", :level=\>:warn}", :exception=\>#\<LogStash::Json::ParserError: Unexpected character (':' (code 58)): was expecting double-quote to start field name  
at [Source: [B@6f9f35c0; line: 1, column: 3]\>, :level=\>:warn}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 8, 2016, 8:13pm UTC](https://discuss.elastic.co/t/parse-logstash-log-with-logstash/49061/2 "2016-05-08T20:13:30Z")

</div>

Yeah, Logstash's log files aren't JSON. There's no simple way of parsing them. Work is ongoing to make Logstash being able to emit JSON logfiles. I dug up the GitHub issue for this just a few days ago and posted it when someone asked the same question.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/parse-logstash-log-with-logstash/49061/3 "2017-07-06T04:58:49Z")

</div>


