# Parsing json file with logstash

**URL:** <https://discuss.elastic.co/t/parsing-json-file-with-logstash/214080>\
**Category:** Logstash\
**Created:** [January 7, 2020, 3:15pm UTC](https://discuss.elastic.co/t/parsing-json-file-with-logstash/214080 "2020-01-07T15:15:23Z")\
**Posts on this page:** 1\
**Showing post:** 11

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 9, 2020, 6:08pm UTC](https://discuss.elastic.co/t/parsing-json-file-with-logstash/214080/11 "2020-01-09T18:08:36Z")

</div>

With that input file and

```
file { path => "/home/user/foo.txt" sincedb_path => "/dev/null" start_position => beginning codec => multiline { pattern => "^Spalanzani" negate => true what => previous auto_flush_interval => 1 multiline_tag => "" } }
filter { json { source => "message" remove_field => ["message"] } }
output { stdout { codec => rubydebug { metadata => false } } }

```

I get a single event

```
{
   "log_url" => "http://127.0.0.1/log.txt",
       "key" => "22op3dfe",
   "raw_msg" => "404.19 – Denied by filtering rule",
       "MD5" => "2c5cddf13ab55a1d4eca955dfa32d245",
    "syntax" => "text",
  "@version" => "1",
    "SHA256" => "766be5c99ba674f985ce844add4bc5ec423e90811fbceer5ec84efa3cf1624f4",
      "user" => "user",
       "URL" => "http://127.0.0.1",
  "YaraRule" => [
    [0] "no_match"
],
    "expire" => "0",
      "size" => 107,
    "source" => "localhost",
       "Msg" => "404 OK",
  "filename" => "log.txt",
"@timestamp" => 2020-01-07T13:59:04.000Z
}
```

---

_[View the full topic](https://discuss.elastic.co/t/parsing-json-file-with-logstash/214080)._