# ParserError with Code 111

**URL:** <https://discuss.elastic.co/t/parsererror-with-code-111/204044>\
**Category:** Logstash\
**Created:** [October 17, 2019, 12:00pm UTC](https://discuss.elastic.co/t/parsererror-with-code-111/204044 "2019-10-17T12:00:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![akihu](https://avatars.discourse-cdn.com/v4/letter/a/e56c9b/32.png) [@akihu](https://discuss.elastic.co/u/akihu)\
**Post date:** [October 17, 2019, 12:00pm UTC](https://discuss.elastic.co/t/parsererror-with-code-111/204044/1 "2019-10-17T12:00:54Z")

</div>

Dear Community,

I've got server sending following json data via filebeat to logstash.  
Logstash version is 6.2.4.  
For some unknown reason to me, logstash returns following error during json filtering:

```auto
Error parsing json {:source=>"message", :raw=>"{orgId=100, fnrId=5740}\", \"action\":\"group login successful\" }", :exception=>#<LogStash::Json::ParserError: Unexpected character ('o' (code 111)): was expecting double-quote to start field name
 at [Source: (byte[])"{orgId=100, fnrId=5740}", "action":"group login successful" }"; line: 1, column: 3]>}

```

This is the data that filebeat sends to Logstash:

```auto
{ "time":"2019-10-17T10:18:48.093Z", "node":"server", "tx":"92abv", "event":"qdgubk3i8huj-934991", "user":"user.name", "userOrg":"example.com", "session":"(md5)4ed2fbf0229d2d93e785c913c", "target":"user.name, fnrId {orgId=100, fnrId=5740}", "action":"group login successful" }

```

Why the Json filter plugin is trying to read json object from the target value string? Shouldn't it just read the whole value as String?  
For my knowledge, example data is following JSON definitions.

Many thanks in advance!

Br,  
Aki

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 14, 2019, 12:00pm UTC](https://discuss.elastic.co/t/parsererror-with-code-111/204044/2 "2019-11-14T12:00:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.