# Pasring Json file **URL:** \ **Category:** Logstash\ **Created:** [February 18, 2019, 12:26pm UTC](https://discuss.elastic.co/t/pasring-json-file/168826 "2019-02-18T12:26:54Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![neo](https://avatars.discourse-cdn.com/v4/letter/n/9fc348/32.png) [@neo](https://discuss.elastic.co/u/neo)\ **Post date:** [February 18, 2019, 12:26pm UTC](https://discuss.elastic.co/t/pasring-json-file/168826/1 "2019-02-18T12:26:54Z")
Hi All, I'm trying to parse json file but I'm getting error and incorrect result the log file look like this: { "Records": [{ "EventVersion": "1.0", "EventSubscriptionArn": "XXX", "EventSource": "XXX", "Sns": { "SignatureVersion": "1", "Timestamp": "2019-02-11T11:24:00.000", "Signature": "XXX", "SigningCertUrl": "XXX", "MessageId": "XXX", "Message": "{"notificationType":"Delivery","mail":{"timestamp":"2019-02-10T11:24:52.986Z","source":"[XXX.com](http://XXX.com)","sourceArn":"[XXX.com](http://XXX.com)","sourceIp":"212.00.00.100","sendingAccountId":"081469076013","messageId":"4654654-000000","destination":["[XXX.com](http://XXX.com)"]},"delivery":{"timestamp":"2019-02-11T11:24:54.199Z","processingTimeMillis":1213,"recipients":["[XXX.com](http://XXX.com)"],"smtpResponse":"100 2.6.0 [01000168dc4d7f7a-3ae05619-0b9e-4deb-82d2-5555018-000000@email.amazonses.com](mailto:01000168dc4d7f7a-3ae05619-0b9e-4deb-82d2-5555018-000000@email.amazonses.com) [InternalId=001, [Hostname=Aoutlook.com](http://Hostname=Aoutlook.com)] 10536 bytes in 0.187, 54.735 KB/sec Queued mail for delivery","remoteMtaIp":"100.00.0.55","reporti":"[amazonses.com](http://amazonses.com)"}}", "MessageAttributes": {}, "Type": "Notification", "UnsubscribeUrl": "XXX", "TopicArn": "XXX", "Subject": null } }] } the conf file look like this: filter { if "emails\_logs" in [tags] { json { source =\> "message" target =\> "message" } json { source =\> "[message][Records]" target =\> "[message][Records]" } split { field =\> "[message][Records][Sns]" } split { field =\> "[message][Records][Sns][Message]" } } } Can you help me to parse it? ---
**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Post date:** [February 18, 2019, 12:38pm UTC](https://discuss.elastic.co/t/pasring-json-file/168826/2 "2019-02-18T12:38:43Z")
The json posted is invalid. On the line where it is says message there are extra " caracters. This is the correct json ``` { "Records": [{ "EventVersion": "1.0", "EventSubscriptionArn": "XXX", "EventSource": "XXX", "Sns": { "SignatureVersion": "1", "Timestamp": "2019-02-11T11:24:00.000", "Signature": "XXX", "SigningCertUrl": "XXX", "MessageId": "XXX", "Message": { "notificationType": "Delivery", "mail": { "timestamp": "2019-02-10T11:24:52.986Z", "source": "XXX.com", "sourceArn": "XXX.com", "sourceIp": "212.00.00.100", "sendingAccountId": "081469076013", "messageId": "4654654-000000", "destination": ["XXX.com"] }, "delivery": { "timestamp": "2019-02-11T11:24:54.199Z", "processingTimeMillis": 1213, "recipients": ["XXX.com"], "smtpResponse": "100 2.6.0 01000168dc4d7f7a-3ae05619-0b9e-4deb-82d2-5555018-000000@email.amazonses.com [InternalId=001, Hostname=Aoutlook.com] 10536 bytes in 0.187, 54.735 KB/sec Queued mail for delivery", "remoteMtaIp": "100.00.0.55", "reporti": "amazonses.com" } }, "MessageAttributes": {}, "Type": "Notification", "UnsubscribeUrl": "XXX", "TopicArn": "XXX", "Subject": null } }] } ``` ---
**Author:** ![neo](https://avatars.discourse-cdn.com/v4/letter/n/9fc348/32.png) [@neo](https://discuss.elastic.co/u/neo)\ **Post date:** [February 18, 2019, 12:55pm UTC](https://discuss.elastic.co/t/pasring-json-file/168826/3 "2019-02-18T12:55:16Z")
Tnx, Do you have idea how to parse it? ---
**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Post date:** [February 18, 2019, 1:23pm UTC](https://discuss.elastic.co/t/pasring-json-file/168826/4 "2019-02-18T13:23:05Z")
Ok, not sure if this is what you need but this is what I got. Config: ``` input { file { path => '/home/pjanzen/json.txt' sincedb_path => '/dev/null' start_position => 'beginning' } } filter { json { source => "message" } } output { stdout { codec => "rubydebug" } } ``` Output: ``` { "path" => "/home/pjanzen/json.txt", "message" => "{\"Records\": [{\"EventVersion\": \"1.0\",\"EventSubscriptionArn\": \"XXX\",\"EventSource\": \"XXX\",\"Sns\": {\"SignatureVersion\": \"1\",\"Timestamp\": \"2019-02-11T11:24:00.000\",\"Signature\": \"XXX\",\"SigningCertUrl\": \"XXX\",\"MessageId\": \"XXX\",\"Message\": {\"notificationType\": \"Delivery\",\"mail\": {\"timestamp\": \"2019-02-10T11:24:52.986Z\",\"source\": \"XXX.com\",\"sourceArn\": \"XXX.com\",\"sourceIp\": \"212.00.00.100\",\"sendingAccountId\": \"081469076013\",\"messageId\": \"4654654-000000\",\"destination\": [\"XXX.com\"]},\"delivery\": {\"timestamp\": \"2019-02-11T11:24:54.199Z\",\"processingTimeMillis\": 1213,\"recipients\": [\"XXX.com\"],\"smtpResponse\": \"100 2.6.0 01000168dc4d7f7a-3ae05619-0b9e-4deb-82d2-5555018-000000@email.amazonses.com [InternalId=001, Hostname=Aoutlook.com] 10536 bytes in 0.187, 54.735 KB/sec Queued mail for delivery\",\"remoteMtaIp\": \"100.00.0.55\",\"reporti\": \"amazonses.com\"}},\"MessageAttributes\": {},\"Type\": \"Notification\",\"UnsubscribeUrl\": \"XXX\",\"TopicArn\": \"XXX\",\"Subject\": null}}]}", "@timestamp" => 2019-02-18T13:21:06.977Z, "@version" => "1", "Records" => [ [0] { "EventVersion" => "1.0", "EventSubscriptionArn" => "XXX", "Sns" => { "Message" => { "mail" => { "timestamp" => "2019-02-10T11:24:52.986Z", "sendingAccountId" => "081469076013", "messageId" => "4654654-000000", "destination" => [ [0] "XXX.com" ], "sourceIp" => "212.00.00.100", "source" => "XXX.com", "sourceArn" => "XXX.com" }, "delivery" => { "processingTimeMillis" => 1213, "timestamp" => "2019-02-11T11:24:54.199Z", "smtpResponse" => "100 2.6.0 01000168dc4d7f7a-3ae05619-0b9e-4deb-82d2-5555018-000000@email.amazonses.com [InternalId=001, Hostname=Aoutlook.com] 10536 bytes in 0.187, 54.735 KB/sec Queued mail for delivery", "reporti" => "amazonses.com", "remoteMtaIp" => "100.00.0.55", "recipients" => [ [0] "XXX.com" ] }, "notificationType" => "Delivery" }, "Signature" => "XXX", "Timestamp" => "2019-02-11T11:24:00.000", "MessageId" => "XXX", "UnsubscribeUrl" => "XXX", "SigningCertUrl" => "XXX", "TopicArn" => "XXX", "Subject" => nil, "SignatureVersion" => "1", "MessageAttributes" => {}, "Type" => "Notification" }, "EventSource" => "XXX" } ], "host" => "tb-clog-ls1" } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 18, 2019, 1:23pm UTC](https://discuss.elastic.co/t/pasring-json-file/168826/5 "2019-03-18T13:23:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.