# Parsing error Logstash with file as input
**URL:** https://discuss.elastic.co/t/parsing-error-logstash-with-file-as-input/256227
**Category:** Logstash
**Created:** [November 21, 2020, 2:48pm UTC](https://discuss.elastic.co/t/parsing-error-logstash-with-file-as-input/256227 "2020-11-21T14:48:09Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Xor44](https://discuss.elastic.co/u/Xor44)
#### Post date: [November 21, 2020, 2:48pm UTC](https://discuss.elastic.co/t/parsing-error-logstash-with-file-as-input/256227/1 "2020-11-21T14:48:09Z")
Hi Folks ,
I'm new in ELK , i'm trying read and parse a file with logstash. But I get some errors during the parsing process
Here is an example of logs
// date="Nov 21 2020 14:36:00" AED="1.1.1.1" type=group\_location pg\_id="3000" pg\_name="TEST on ASP-LAB1" country="US" bpsPassed="18" bpsDropped="0" ppsPassed="0" ppsDropped="0"
date="Nov 21 2020 14:37:00" AED="1.1.1.1" type=group\_location pg\_id="3000" pg\_name="TEST on ASP-LAB1" country="US" bpsPassed="36" bpsDropped="0" ppsPassed="0" ppsDropped="0"
//
input {
file{
path =\> "/home/data/aed\_ts-\*"
start\_position =\> "beginning"
sincedb\_path =\> "NUL"
codec =\> json }
}
filter {
json {
source =\> "message"
}
}
output {
elasticsearch {
index =\> "ed-test-1%{+YYYY.MM.dd}"
hosts =\> ["[https://es01:9200](https://es01:9200/)"]
ssl =\> true
ssl\_certificate\_verification =\> false
cacert =\> "/usr/share/logstash/certs/ca/ca.crt"
manage\_template =\> false
user =\> "elastic"
password =\> "${ELASTIC\_PASSWORD}"
}
}
//
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 21, 2020, 3:09pm UTC](https://discuss.elastic.co/t/parsing-error-logstash-with-file-as-input/256227/2 "2020-11-21T15:09:30Z")
Those logs are not JSON, so both the json codec and the json filter will produce errors. Remove the json codec and replace the json filter with a [kv](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 19, 2020, 3:09pm UTC](https://discuss.elastic.co/t/parsing-error-logstash-with-file-as-input/256227/3 "2020-12-19T15:09:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.