, :level=\>:warn}
Any ideas? Thanks.
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 9, 2016, 2:30pm UTC](https://discuss.elastic.co/t/parsing-json-with-delimiters-using-logstash/49281/10 "2016-05-09T14:30:28Z")
It's really surprising to see `raw=>{}` because it means json is empty.
Is it you who remove content for confidential reasons ?
If it is the reason, could you give the content, replacing confidential data by "value1", ... ?
Another surprising thing : raw content should be like `[{json1},{json2}]`
Upon your log, it seems there are no brackets around json.
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 9, 2016, 9:24pm UTC](https://discuss.elastic.co/t/parsing-json-with-delimiters-using-logstash/49281/11 "2016-05-09T21:24:19Z")
If your log line is equals to this :
`[FlowContextId1] Host:abc1 | Type:Report | Status:Success | ReportName:Count report | ReportBody:{"prop1": val1, "prop2":val2}${"prop1": val3, "prop2":val4}${"prop1": val5, "prop2":val6} | Failures:0`
The problem is that you json is invalid, because val1, val2, ... are not quoted strings.
In your real data, is it a number or a real string ?
If it is a real string, it must be quoted to be valid.
The good format is :
`[FlowContextId1] Host:abc1 | Type:Report | Status:Success | ReportName:Count report | ReportBody:{"prop1": "val1", "prop2":"val2"}${"prop1": "val3", "prop2":"val4"}${"prop1": "val5", "prop2":"val6"} | Failures:0`
I try with this line and it works.
---
### Author:  [@LoriG](https://discuss.elastic.co/u/LoriG)
#### Post date: [May 10, 2016, 11:06am UTC](https://discuss.elastic.co/t/parsing-json-with-delimiters-using-logstash/49281/12 "2016-05-10T11:06:35Z")
To be clearer "prop1" is really "count" and its value is an integer. However, the value of "prop2" is a string. When I just included the first line of the configuration that you sent, so I can see what json I receive, I got:
json:
{ "count" : 1 , "prop2" : "value1"}${ "count" : 9 , "prop2" : "value2"}${ "count" : 11 , "prop2" : "value3"}${ "count" : 15 , "prop2" : "value4"}. Is there something I need to change in the logstash config that you gave me, since my json values include integers and strings?
Thanks.
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 10, 2016, 12:54pm UTC](https://discuss.elastic.co/t/parsing-json-with-delimiters-using-logstash/49281/13 "2016-05-10T12:54:31Z")
There is nothing to do in logstash to process numbers and strings, this works fine since number values are not quoted and string values are quoted.
That said, If you still have json parse errors and want I help you, you'll have to give more details than :
> [@LoriG](#):
>
> Trouble parsing json {:source=\>"json", :raw=\>{}, :exception=\># at [Source: [B@64477cb0; line: 1, column: 185]\>, :level=\>:warn}
What is the real "raw" referenced in json filter error ? It is not just `{}` ?
What is the exact initial log line in input ?
---
### Author:  [@LoriG](https://discuss.elastic.co/u/LoriG)
#### Post date: [May 10, 2016, 6:59pm UTC](https://discuss.elastic.co/t/parsing-json-with-delimiters-using-logstash/49281/14 "2016-05-10T18:59:41Z")
The json that displays in Discover is:
[{ "count" : 1 , "deviceType" : "iPad.3.0"},{ "count" : 9 , "deviceType" : "Android.6.0"},{ "count" : 9 ,
"deviceType" : "iPad.3.1"},{ "count" : 9 , "deviceType" : "Android.7.0"}
I see I am not getting end of array. Therefore, if I then comment back in the following ( before I commented out, because I wanted to see what is the json I get), I get the error below, "json {
source =\> "json"
target =\> "json"
}
The error is (the raw{} is blank because it can't read json, I guess:
Trouble parsing json {:source=\>"json", :raw=\>{}, :exception=\>#\, :level=\>:warn}
I tried different ways in logstash config to display the end of array, but didn't. Any ideas? Your help is great.
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 10, 2016, 9:48pm UTC](https://discuss.elastic.co/t/parsing-json-with-delimiters-using-logstash/49281/15 "2016-05-10T21:48:20Z")
Hi,
I tried to put in input this message :
`[FlowContextId1] Host:abc1 | Type:Report | Status:Success | ReportName:Count report | ReportBody:{ "count" : 1 , "deviceType" : "iPad.3.0"}${ "count" : 9 , "deviceType" : "Android.6.0"}${ "count" : 9 ,"deviceType" : "iPad.3.1"}${ "count" : 9 , "deviceType" : "Android.7.0"} | Failures:0`
If you have still problems, I'm invite you to give me your input log line.
And it works perfectly (with exactly the same configuration I indicated previously).
At the end, I've got this :
```
"iPad.3.0" => 1,
"Android.6.0" => 9,
"iPad.3.1" => 9,
"Android.7.0" => 9
```
I invite you to test with this input to see the result (and tell me) :
```
output {
stdout {
codec => rubydebug { }
}
}
```
That said, you try to put in elasticsearch fields with `.` characters in their names.
That's a problem.
So at filter chain end, I invite you to add :
```
de_dot {
}
```
This will replace '.' by '\_'.
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 10, 2016, 9:50pm UTC](https://discuss.elastic.co/t/parsing-json-with-delimiters-using-logstash/49281/16 "2016-05-10T21:50:11Z")
To finish, it's weird to use "iPad.3.0" as a field name...
That doesn't look like a field name, but more like a field value.
Maybe, it's more relevant to make analytics processing in elasticsearch, using kibana.
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 11, 2016, 8:02am UTC](https://discuss.elastic.co/t/parsing-json-with-delimiters-using-logstash/49281/17 "2016-05-11T08:02:24Z")
The missing closing bracket is surprising.
Are you sure you don't forget closing bracket here :
`replace =>; { "json" > "[%{json}]" }`
---
### Author:  [@LoriG](https://discuss.elastic.co/u/LoriG)
#### Post date: [May 11, 2016, 3:07pm UTC](https://discuss.elastic.co/t/parsing-json-with-delimiters-using-logstash/49281/18 "2016-05-11T15:07:41Z")
Fabien,
I have been trying to figure out why I am getting this error of the missing bracket, but haven't been successful. Below is what I get in standard output that you requested, IF I comment out the section in config regarding source/target, otherwise I get the error that it is looking for the end bracket.
LOG:
"FCID" =\> "573348D284AEAEF5C842BFED",
"ReportName" =\> "Count report",
"ReportBody" =\> "{ "count" : 1 , "deviceType" : "iPad.3\_0"}${ "count" : 9 , "deviceType" : "iPad.3\_1"}${ "count" : 9 , "deviceType" : "iPad.3\_2"}${ "count" : 9 , "deviceType" : "iPad.3-3"}",
"Failures" =\> "0",
"result" =\> "ok",
"json" =\> "[{ "count" : 1 , "deviceType" : "iPad.3\_0"}${ "count" : 9 , "deviceType" : "iPad.3\_1"}${ "count" : 9 , "deviceType" : "iPad.3\_2"}${ "count" : 9 , "deviceType" : "iPad.3-3"}"
Configuration:
grok {
match =\> ["message", "ReportBody:%{DATA:json} |"]
}
```
mutate {
gsub => ["json" , "\$", ","]
}
mutate {
replace => { "json" => "[%{json}]" }
}
```
# json {
# source =\> "json"
# target =\> "json"
# }
# ruby {
# code =\> "event['json'].each { |item| event[item['deviceType']] = item['count'] }"
# }
```
mutate {
remove_field => ["message"]
}
```
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 11, 2016, 3:36pm UTC](https://discuss.elastic.co/t/parsing-json-with-delimiters-using-logstash/49281/19 "2016-05-11T15:36:36Z")
OK, so we have exactly the same configuration, but it works for me and not for you ☹
The only reason I see is logstash version.
I use last one (2.3.2).
Which logstash version do you use ?
---
### Author:  [@LoriG](https://discuss.elastic.co/u/LoriG)
#### Post date: [May 11, 2016, 3:52pm UTC](https://discuss.elastic.co/t/parsing-json-with-delimiters-using-logstash/49281/20 "2016-05-11T15:52:25Z")
1.5.3:(I could try to install later version. Thanks so much for all your help!
[Next page](https://discuss.elastic.co/t/parsing-json-with-delimiters-using-logstash/49281.md?page=2)