# Parsing json file

**URL:** <https://discuss.elastic.co/t/parsing-json-file/111224>\
**Category:** Logstash\
**Created:** [December 12, 2017, 4:14am UTC](https://discuss.elastic.co/t/parsing-json-file/111224 "2017-12-12T04:14:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [December 12, 2017, 4:14am UTC](https://discuss.elastic.co/t/parsing-json-file/111224/1 "2017-12-12T04:14:34Z")

</div>

Hi All,

I am trying to parse the .json file its perfectly getting parsed when I do stdin i.e. per entry but .json being a file with comma separated entries how do I parse using file input parameter?

here is my file and message  
[{"remote\_host":"112.124.98.67","count":"22995","last\_seen":"2017-12-11"},{"remote\_host":"38.122.220.1","count":"22163","last\_seen":"2017-12-11"},{"remote\_host":"40.135  
.239.38","count":"18804","last\_seen":"2017-12-12"},{"remote\_host":"112.5.237.78","count":"17875","last\_seen":"2017-12-11"},{"remote\_host":"185.148.145.243","count":"151  
15","last\_seen":"2017-12-10"},{"remote\_host":"113.195.145.52","count":"14414","last\_seen":"2017-12-11"},{"remote\_host":"221.200.82.180","count":"14116","last\_seen":"201  
7-12-12"},{"remote\_host":"114.39.123.78","count":"13687","last\_seen":"2017-12-11"},{"remote\_host":"60.6.231.144","count":"11871","last\_seen":"2017-12-10"},{"remote\_host  
":"60.6.231.187","count":"10081","last\_seen":"2017-12-10"},{"remote\_host":"59.56.66.62","count":"10043","last\_seen":"2017-12-11"},{"remote\_host":"60.6.230.105","count":  
"9850","last\_seen":"2017-12-10"},{"remote\_host":"221.192.242.58","count":"9149","last\_seen":"2017-12-10"},{"remote\_host":"113.195.145.21","count":"8877","last\_seen":"20  
17-12-11"},{"remote\_host":"114.55.207.244","count":"7542","last\_seen":"2017-12-11"}]

####################  
`input {

# file {

# codec =\> json

# path =\> "/tmp/ishp.json"

# start\_position =\> "beginning"

# 

# }

```
            stdin { }

```

}

filter {  
grok {  
match =\> [ "message", '%{WORD:host}":"%{IPV4:ipaddr}","%{WORD:count}":"%{INT:nooftimes}","%{WORD:lastseen}":"%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:d  
ay}"' ]  
}  
geoip { source =\> "ipaddr" }

}  
output {

# elasticsearch {

# hosts =\> ["172.xx.xx.xx:9200"]

# index =\> "logstash-hp-%{+YYYY.MM.dd}"

# template =\> "/etc/logstash/logstash-template.json"

# }

# }

```
    stdout { codec => rubydebug }

```

}  
`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 12, 2017, 7:02am UTC](https://discuss.elastic.co/t/parsing-json-file/111224/2 "2017-12-12T07:02:08Z")

</div>

Is `[{"remote_host": ... "last_seen":"2017-12-11"}]` all on one line? And you have multiple such lines in the input file?

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [December 13, 2017, 3:17am UTC](https://discuss.elastic.co/t/parsing-json-file/111224/3 "2017-12-13T03:17:44Z")

</div>

That is correct for time being I edited the file with sed and added /n but I believe there has to be a better way, right?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 10, 2018, 3:17am UTC](https://discuss.elastic.co/t/parsing-json-file/111224/4 "2018-01-10T03:17:57Z")

</div>

Closed on January 10, 2018, 3:17am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.