# Parse single-line json with logstash
**URL:** https://discuss.elastic.co/t/parse-single-line-json-with-logstash/373096
**Category:** Logstash
**Created:** [January 12, 2025, 9:44am UTC](https://discuss.elastic.co/t/parse-single-line-json-with-logstash/373096 "2025-01-12T09:44:26Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Resort](https://discuss.elastic.co/u/Resort)
#### Post date: [January 12, 2025, 9:44am UTC](https://discuss.elastic.co/t/parse-single-line-json-with-logstash/373096/1 "2025-01-12T09:44:26Z")
Hello, I'm looking for assistance with my attempt of passing logs of .json type to Elasticsearch using Logstash.
The tricky moment is that the .json file contains one single valid data and is being ignored by Logstash.
Example of .json log content:
```auto
{"playerName":"Medico","logSource":"Bprint","location":[12.505,29.147]}
```
Config file for Logstash:
```auto
input {
file {
path => "C:/logs/*.json"
start_position => "beginning"
sincedb_path => "NUL"
}
}
filter {
mutate {
gsub => ["message", "\]\}", "]}
" ]
}
split {
field => "message"
}
json{
source=> "message"
remove_field => ["{message}"]
}
mutate {
remove_field => ["message", "host", "@version", "type"]
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
manage_template => false
index => "map"
}
stdout { codec => rubydebug }
}
```
As you see, my approach was to treat the .json input as plaint text and mutate it with gsub by adding a newline in the end of the raw string and then treat it as json.
The reason for this approach is that if I manually modify the created .json log file by adding a newline (pressing Enter key) and save – Logstash parses data and sends to Elastcsearch as expected (no gsub mutation is required in that case).
Also, I was inspired by [this topic](https://discuss.elastic.co/t/parse-single-line-multi-object-json-with-logstash/207608/5)
But the approach does not work. I've tried multiple other approaches (like using multiline, json\_lines, json codecs) and different gsub variations with no success. **As long as .json has single line, it won't evoke Logstash**. Looking for some support here. Thanks in advance!
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [January 12, 2025, 11:31am UTC](https://discuss.elastic.co/t/parse-single-line-json-with-logstash/373096/2 "2025-01-12T11:31:47Z")
This should work.
```auto
input {
file {
path => "C:/logs/*.json"
start_position => beginning
sincedb_path => "NUL"
delimiter => "]}"
}
}
filter {
mutate { update => { "message" => "%{message}]}" } }
if [message] =~ /^\r\n/ {
mutate { gsub => ["message", "\r\n", ""] }
}
json{
source=> "message"
}
#mutate{ remove_field => ["log", "host", "event", "@version", "@timestamp"] }
}
output {
stdout {}
}
```
You can also use `}` as delimeter if is JSON doesn't have objects.
---
### Author:  [@Resort](https://discuss.elastic.co/u/Resort)
#### Post date: [January 12, 2025, 12:56pm UTC](https://discuss.elastic.co/t/parse-single-line-json-with-logstash/373096/3 "2025-01-12T12:56:35Z")
Thanks a lot for quick reply, Rios!
I made it work thanks to your suggestion. The config file now looks the following:
```auto
input {
file {
path => "C:/logs/*"
start_position => "beginning"
sincedb_path => "NUL"
codec => plain {
charset => "UTF-16LE"
}
delimiter => "}"
}
}
filter {
mutate { update => { "message" => "%{message}}" } }
if [message] =~ /^\r\n/ {
mutate { gsub => ["message", "\r\n", "}"] }
}
split {
field => "message"
}
json{
source=> "message"
remove_field => ["{message}"]
}
mutate {
remove_field => ["message", "host", "@version", "type"]
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
manage_template => false
index => "map"
}
stdout { codec => rubydebug }
}
```
My json log would not have nested objects, so I decided to not use ] in delimiter.
Cheers!
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [January 12, 2025, 2:48pm UTC](https://discuss.elastic.co/t/parse-single-line-json-with-logstash/373096/4 "2025-01-12T14:48:21Z")
You are welcome.
Long ling the king and the Elastic team.