# Parsing JSON error Logstash **URL:** \ **Category:** Logstash\ **Created:** [June 25, 2018, 7:55am UTC](https://discuss.elastic.co/t/parsing-json-error-logstash/137207 "2018-06-25T07:55:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![SuperK\_1860](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@SuperK\_1860](https://discuss.elastic.co/u/SuperK_1860)\ **Post date:** [June 25, 2018, 7:55am UTC](https://discuss.elastic.co/t/parsing-json-error-logstash/137207/1 "2018-06-25T07:55:10Z")
Hi all I am trying to import a JSON file but I get the following error. filter { json { # This setting must be a string # Expected string, got ["followUpDate", "dateOfBirth", "medical.dateFinalised", "medical.dateOfEntry", "medical.dateOfSuspension", "medical.dateOfWithdrawal", "medical.gapDateFinalised", "medical.gapDateOfEntry", "medical.gapDateOfSuspension", "medical.gapDateOfWithdrawal", "medical.loyaltyDateFinalised", "medical.loyaltyDateOfEntry", "medical.loyaltyDateOfSuspension", "medical.loyaltyDateOfWithdrawal", "medical.loyalty", "medical.loyaltyStatus", "medical.monthlyTotalContribution", "medical.monthlyRiskContribution", "medical.monthlyMSAContribution", "medical.monthlyLoyaltyContribution", "medical.monthlyOtherContribution", "medical.totalYearToDate", "medical.mostRecentBillDate", "medical.chronic", "medical.msaPayoutChoice", "medical.msaCarryOver", "medical.msaAnnual", "medical.msaProrated", "medical.msaBalance", "medical.annualThreshold", "medical.thresholdProrated", "medical.msaSpent", "medical.amountAccumulatedToThreshold", "medical.currentSPG", "medical.thresholdIndicator", "medical.ihPaid", "medical.lastUpdated", "medical.status", "title", "firstname", "surname", "idNumber", "gender", "employerName", "employer.value", "employer.label", "employer.type\_of", "employer.employerNumber", "employer\_id", "employerBranch", "occupation", "email", "cellphone", "salary", "status", "initials", "fsp\_id", "consultant\_id", "type\_of", "broker.name", "broker.houseName", "broker.houseCode", "broker.code", "dates.dateOfEntry", "dates.dateOfWithdrawal", "updateSource", "history.0.creator.label", "history.0.creator.value", "history.0.type", "history.0.from", "history.0.to", "history.0.data", "history.0.source", "history.0.timestamp", "currentScheme", "employerNumber", "employerBranchNumber", "memberNumber", "employeeNumber", "language", "numDependants", "numSpouses", "numAdults", "numChildren", "currentOption", "workTelCode", "workTelNumber", "postalAddress1", "postalAddress2", "postalAddress3", "postalSuburb", "postalPostCode", "deleted\_at"] source =\> ["followUpDate", "dateOfBirth", "medical.dateFinalised", "medical.dateOfEntry", "medical.dateOfSuspension", "medical.dateOfWithdrawal", "medical.gapDateFinalised", "medical.gapDateOfEntry", "medical.gapDateOfSuspension", "medical.gapDateOfWithdrawal", "medical.loyaltyDateFinalised", "medical.loyaltyDateOfEntry", "medical.loyaltyDateOfSuspension", "medical.loyaltyDateOfWithdrawal", "medical.loyalty", "medical.loyaltyStatus", "medical.monthlyTotalContribution", "medical.monthlyRiskContribution", "medical.monthlyMSAContribution", "medical.monthlyLoyaltyContribution", "medical.monthlyOtherContribution", "medical.totalYearToDate", "medical.mostRecentBillDate", "medical.chronic", "medical.msaPayoutChoice", "medical.msaCarryOver", "medical.msaAnnual", "medical.msaProrated", "medical.msaBalance", "medical.annualThreshold", "medical.thresholdProrated", "medical.msaSpent", "medical.amountAccumulatedToThreshold", "medical.currentSPG", "medical.thresholdIndicator", "medical.ihPaid", "medical.lastUpdated", "medical.status", "title", "firstname", "surname", "idNumber", "gender", "employerName", "employer.value", "employer.label", "employer.type\_of"] ... } } [ERROR] 2018-06-25 09:48:01.205 [LogStash::Runner] agent - Cannot create pipeline {:reason=\>"Something is wrong with your configuration."} My logstash config file is the following: input { file { path =\> "/home/uadmin/Healthcare/nmgmem.json" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { json{ source =\> [ "followUpDate", "dateOfBirth", "medical.dateFinalised", "medical.dateOfEntry", "medical.dateOfSuspension", "medical.dateOfWithdrawal", "medical.gapDateFinalised", "medical.gapDateOfEntry", "medical.gapDateOfSuspension", "medical.gapDateOfWithdrawal", "medical.loyaltyDateFinalised", "medical.loyaltyDateOfEntry", "medical.loyaltyDateOfSuspension", "medical.loyaltyDateOfWithdrawal", "medical.loyalty", "medical.loyaltyStatus", "medical.monthlyTotalContribution", "medical.monthlyRiskContribution", "medical.monthlyMSAContribution", "medical.monthlyLoyaltyContribution", "medical.monthlyOtherContribution", "medical.totalYearToDate", "medical.mostRecentBillDate", "medical.chronic", "medical.msaPayoutChoice", "medical.msaCarryOver", "medical.msaAnnual", "medical.msaProrated", "medical.msaBalance", "medical.annualThreshold", "medical.thresholdProrated", "medical.msaSpent", "medical.amountAccumulatedToThreshold", "medical.currentSPG", "medical.thresholdIndicator", "medical.ihPaid", "medical.lastUpdated", "medical.status", "title","firstname","surname", "idNumber", "gender", "employerName", "employer.value", "employer.label", "employer.type\_of"] ``` } ``` } output { elasticsearch { hosts =\> "localhost" index =\> "nmg-jsontest" document\_type =\> "test" ``` } stdout{} ``` } ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 25, 2018, 8:05am UTC](https://discuss.elastic.co/t/parsing-json-error-logstash/137207/2 "2018-06-25T08:05:37Z")
The `source` parameter in the JSON filter should indicate which field to parse JSON from. I do not know what you are trying to do, but what you have specified there is not correct. Have a look in the documentation for an example. ---
**Author:** ![SuperK\_1860](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@SuperK\_1860](https://discuss.elastic.co/u/SuperK_1860)\ **Post date:** [June 25, 2018, 8:12am UTC](https://discuss.elastic.co/t/parsing-json-error-logstash/137207/3 "2018-06-25T08:12:54Z")
Thank you for your response, I am actully trying to pipe a mongoDB json export into ES for analysis. Here is one document {"\_id":{"$oid":"5aeaf4e916df6f665a26b742"},"dependants":[],"tags":[],"followUpDate":null,"idUnknown":true,"dateOfBirth":"09/06/1984","medical":{"dateFinalised":null,"dateOfEntry":"2018/06/01","dateOfSuspension":null,"dateOfWithdrawal":"9999/12/31","gapDateFinalised":null,"gapDateOfEntry":null,"gapDateOfSuspension":null,"gapDateOfWithdrawal":null,"loyaltyDateFinalised":null,"loyaltyDateOfEntry":null,"loyaltyDateOfSuspension":null,"loyaltyDateOfWithdrawal":null,"loyalty":"NO","loyaltyStatus":"","monthlyTotalContribution":"2773","monthlyRiskContribution":"2080","monthlyMSAContribution":"693","monthlyLoyaltyContribution":"0","monthlyOtherContribution":"0","totalYearToDate":"2773","mostRecentBillDate":"01/06/2018","chronic":"NO","msaPayoutChoice":"DH Rate"} Hope that makes sense. I will check docs. Regards K ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 25, 2018, 8:15am UTC](https://discuss.elastic.co/t/parsing-json-error-logstash/137207/4 "2018-06-25T08:15:02Z")
If you output to the `stdout` plugin with a `rubydebug` codec, you will be able to see what the event looks like, which makes it easier to apply the correct filters. This also makes it a lot easier for anyone helping out. ---
**Author:** ![SuperK\_1860](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@SuperK\_1860](https://discuss.elastic.co/u/SuperK_1860)\ **Post date:** [June 25, 2018, 8:15am UTC](https://discuss.elastic.co/t/parsing-json-error-logstash/137207/5 "2018-06-25T08:15:42Z")
Thank you I will try that route, appreciate the help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 23, 2018, 8:15am UTC](https://discuss.elastic.co/t/parsing-json-error-logstash/137207/6 "2018-07-23T08:15:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.