# Partial logs ingested by logstash causing \_jsonparsefailure

**URL:** https://discuss.elastic.co/t/partial-logs-ingested-by-logstash-causing-jsonparsefailure/187999
**Category:** Logstash
**Created:** [June 28, 2019, 9:14am UTC](https://discuss.elastic.co/t/partial-logs-ingested-by-logstash-causing-jsonparsefailure/187999 "2019-06-28T09:14:50Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![nikhilo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikhilo/32/21230_2.png) [@nikhilo](https://discuss.elastic.co/u/nikhilo)
#### Post date: [June 28, 2019, 9:14am UTC](https://discuss.elastic.co/t/partial-logs-ingested-by-logstash-causing-jsonparsefailure/187999/1 "2019-06-28T09:14:50Z")

</div>

We're ingesting logs from a file in JSON format. Here's the config,

```
input {
  file {
     'codec' => 'json'
     'path' => '/mnt/log/app/json.log*'
     'type' => 'erlang'
     'sincedb_path' => '/usr/share/logstash/data/.sincedb_app_json'
  }
}

```

We're noticing that sometimes partial lines get ingested into elasticsearch.

 ![logstash-partial-ingest3](https://us1.discourse-cdn.com/elastic/original/3X/6/0/604ac8b60f3c2aeed4b0b1d9313a5c71a5874841.png)  
As you can seen in the "message" field, the line starts somewhere in the middle of the actual line in file.  
When trying to look at the same line in the actual file, looks like the line is a valid json.

```
user@hostname:/var/log/app# grep "2019-06-28T00:00:00.230" json.log | jq "."
{
  "node": "node1@hostname.company.domain",
  "pid": "<0.1417.148>",
  "line": 988,
  "function": "some_func",
  "module": "some_module",
  "application": "some_app",
  "some": "593479e7-0a3d-4369-b08a-6dbe3d77f542",
  "more": "f11cfd2f-0e7b-47f6-877f-37626b50ac76",
  "fields": "Blah",
  "message": "Msg Status",
  "@timestamp": "2019-06-28T00:00:00.230",
  "level": "info"
}

```

logstash version: 5.5.2

Notably, all such occurrences have the initial part cut off from the logs, but never the end of the line.

Any idea about what could be the problem here?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 26, 2019, 9:14am UTC](https://discuss.elastic.co/t/partial-logs-ingested-by-logstash-causing-jsonparsefailure/187999/2 "2019-07-26T09:14:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.