# Parsing JSON in Logstash - Getting \_jsonparsefailure error

**URL:** <https://discuss.elastic.co/t/parsing-json-in-logstash-getting-jsonparsefailure-error/165386>\
**Category:** Logstash\
**Created:** [January 23, 2019, 11:16am UTC](https://discuss.elastic.co/t/parsing-json-in-logstash-getting-jsonparsefailure-error/165386 "2019-01-23T11:16:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vivek\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivek_sharma/32/46948_2.png) [@Vivek\_Sharma](https://discuss.elastic.co/u/Vivek_Sharma)\
**Post date:** [January 23, 2019, 11:16am UTC](https://discuss.elastic.co/t/parsing-json-in-logstash-getting-jsonparsefailure-error/165386/1 "2019-01-23T11:16:31Z")

</div>

Hi

I am trying to parse a JSON file as below:

> ```
> {
> "glossary": {
> "title": "example glossary",
> "GlossDiv": {
> "title": "S",
> "GlossList": {
> "GlossEntry": {
> "ID": "SGML",
> "SortAs": "SGML",
> "GlossTerm": "Standard Generalized Markup Language",
> "Acronym": "SGML",
> "Abbrev": "ISO 8879:1986",
> "GlossDef": {
> "para": "A meta-markup language, used to create markup languages such as DocBook.",
> "GlossSeeAlso": ["GML", "XML"]
> },
> "GlossSee": "markup"
> }
> }
> }
> }
> }
> 
> ```

Below is the logstash configuration for this:

> ```
> > input {
> > file {
> > start_position => beginning
> > path => ["D:/ELK Demo Logs/POC/JSON/*.JSON"]
> > codec => "json"
> > add_field => ["log_type","JSON"]
> > }
> > }
> > 
> > 
> > # The filter part of this file is commented out to indicate that it is
> > # optional.
> > filter { 
> > if [log_type] == "JSON" {
> > json {
> > source => "message"
> > target => "parsedJSON"
> > }
> > 					
> > mutate { 
> > add_field => ["Log_Source", "JSON"]
> > 		
> > }
> > }
> > }
> > 
> > output {
> > elasticsearch {
> > hosts => "localhost:9200"
> > manage_template => false
> > index => "filebeat-%{+YYYY.MM.dd}" 
> > }
> > stdout { codec => rubydebug }
> > }
> 
> ```

But when I run logstash and try to parse JSON file, I get \_jsonparsefailure error.

Please find below the error snapshot.

 ![JSON%20Error](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a78d333ad5badb67d59352f314a64ba3f66e3688.jpeg)

Can anyone please help in getting this issue resolved. Struggling since last one week for this issue.

Thanks

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [January 23, 2019, 1:24pm UTC](https://discuss.elastic.co/t/parsing-json-in-logstash-getting-jsonparsefailure-error/165386/2 "2019-01-23T13:24:39Z")

</div>

HI,

Your input [add field is wrong.](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-add_field)

Also you should not post images, those can be very hard to read depending on your device.

Paul.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 23, 2019, 1:31pm UTC](https://discuss.elastic.co/t/parsing-json-in-logstash-getting-jsonparsefailure-error/165386/3 "2019-01-23T13:31:17Z")

</div>

A file input reads a file one line at a time unless you use a multiline filter. In this case you appear to want to read the entire file as one event. To do that you can use a multiline filter with a pattern that never matches

```
input {
    file {
       path => "/some/path/foo.json"
       sincedb_path => "/dev/null" 
       start_position => "beginning" 
       mode => "tail"
       codec => multiline {
           pattern => "^Spalanzani"
           negate => true 
           what => "previous" 
           auto_flush_interval => 1
       }
    }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 20, 2019, 1:31pm UTC](https://discuss.elastic.co/t/parsing-json-in-logstash-getting-jsonparsefailure-error/165386/4 "2019-02-20T13:31:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.