at [Source: [B@4f638d4; line: 37, column: 866]\>}
sensor1.json
> {
> "sensor-time" : {
> "timezone" : "UTC",
> "time" : "2017-09-06T08:00:02Z"
> },
> "status" : {
> "code" : "OK"
> },
> "content" : {
> "element" : [ {
> "element-id" : 0,
> "element-name" : "Line 0",
> "sensor-type" : "SINGLE\_SENSOR",
> "data-type" : "LINE",
> "from" : "2017-09-06T07:00:00Z",
> "to" : "2017-09-06T08:00:00Z",
> "resolution" : "ONE\_HOUR",
> "measurement" : [ {
> "from" : "2017-09-06T07:00:00Z",
> "to" : "2017-09-06T08:00:00Z",
> "value" : [ {
> "value" : 10,
> "label" : "fw"
> }, {
> "value" : 10,
> "label" : "bw"
> } ]
> } ]
> } ]
> },
> "sensor-info" : {
> "serial-number" : "00:1E:C0:9D:41:ED",
> "ip-address" : "10.0.100.12",
> "name" : "Wireless Sensor 01",
> "group" : "SDS Wireless Lab",
> "device-type" : "PC2R"
> }
> }
Pipeline.conf
> input {
> beats {
> type=\> beats
> port =\> "5043"
> codec=\> json
> }
> }
>
> filter{
> json{
> source =\> "message"
> }
> mutate {
> remove\_field =\> ["type", "tags"]
> add\_field =\> {
> "time" =\> "%{[sensor-time][time]}"
> "serial-number" =\> "%{[sensor-info][serial-number]}"
> "ip-address" =\> "%{[sensor-info][ip-address]}"
> "group" =\> "%{[sensor-info][group]}"
> }
> }
> }
>
> output {
> elasticsearch {
> hosts =\> ["localhost:9200"]
> index =\> "sensor"
> }
> stdout { codec =\> rubydebug { metadata =\> true }}
> }
filebeat.yml
> filebeat.prospectors:
>
> - input\_type: log
> paths:
> - C:\Users\mufashid.manantavid\Desktop\Xovis Json\*.json
> multiline.pattern: '^{'
> multiline.negate: true
> multiline.match: after
> #fields\_under\_root: true
> #json.keys\_under\_root: true
> #json.add\_error\_key: true
> #fields:
> #tags: ['json']
>
> output.logstash:
> hosts: ["localhost:5043"]
> #template.name: filebeat
> template.path: filebeat.template.json
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [September 10, 2017, 4:02pm UTC](https://discuss.elastic.co/t/parsing-json-file-with-logstash-and-filebeat/99925/2 "2017-09-10T16:02:33Z")
This approach does not always work.
In the filebeat, the negated pattern is `^{`. It accumulates lines of data and because there is no `{` following the last `}` (and perhaps also no newline after the last `}`) the last `}` is never sent to logstash. This means that the JSON is malformed as the error message says.
Try adding a newline after the last `}`.
I am not very familiar with the exact algorithm that filebeat uses (it was once coded very similar to LS multiline code, but I think the beats team have made some improvements).
---
### Author:  [@Mufashid](https://discuss.elastic.co/u/Mufashid)
#### Post date: [September 11, 2017, 9:08am UTC](https://discuss.elastic.co/t/parsing-json-file-with-logstash-and-filebeat/99925/3 "2017-09-11T09:08:19Z")
How do I do that.
---
### Author:  [@Mufashid](https://discuss.elastic.co/u/Mufashid)
#### Post date: [September 11, 2017, 12:04pm UTC](https://discuss.elastic.co/t/parsing-json-file-with-logstash-and-filebeat/99925/4 "2017-09-11T12:04:56Z")
if I add new line to 1 json file it is working fine but I am using more than 1 json file(Data is pusing from the external device). Is there any solution for add new line from filebeat or logstash.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 9, 2017, 12:04pm UTC](https://discuss.elastic.co/t/parsing-json-file-with-logstash-and-filebeat/99925/5 "2017-10-09T12:04:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.