# Problem with JSON

**URL:** <https://discuss.elastic.co/t/problem-with-json/208896>\
**Category:** Logstash\
**Created:** [November 21, 2019, 1:47pm UTC](https://discuss.elastic.co/t/problem-with-json/208896 "2019-11-21T13:47:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Parry](https://avatars.discourse-cdn.com/v4/letter/p/bbce88/32.png) [@Parry](https://discuss.elastic.co/u/Parry)\
**Post date:** [November 21, 2019, 1:47pm UTC](https://discuss.elastic.co/t/problem-with-json/208896/1 "2019-11-21T13:47:50Z")

</div>

Hello. I have problem with json logs. Some of logs isn't pushed to Elastic+Kibana properly. I get this error:

"[2019-11-21T08:51:24,441][ERROR][logstash.codecs.json][main] JSON parse error, original data now in message field {:error=\>#\<LogStash::Json::ParserError: Unexpected character (',' (code 44)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')  
at [Source: (String)", "sgDuration": 203, "sgCategory": "Under1000ms", "CallerMemberName": "LogIfSlowExecution", "CallerFilePath": "X:\TC\sssssssssssssssssssssssssssssssssssssssss", "CallerLineNumber": 146 }  
"; line: 1, column: 2]\>, :data=\>", "sgDuration": 203, "sgCategory": "Under1000ms", "CallerMemberName": "LogIfSlowExecution", "CallerFilePath": "ssssssssssssssssssssssssssssssssss", "CallerLineNumber": 146 }\r"}"

In file where logs is placed - original log:  
{ "@timestamp": "2019-10-11T13:41:56.617Z", "event\_timestamp": "2019-10-11T13:41:56.6171499Z", "level": "Warn", "Logger": "Creadhoc.Common.NH.SessionManager", "message": "SlowGet SessionManager Instance", "messageTemplate": "SlowGet SessionManager Instance", "MachineName": "ssssssssssss", "ApplicationType": "sssssssss", "Version": "0.0.0.0", "Branch": "release/0.0", "Environment": "Testing", "DeploymentDestination": "200171", "AspNET-MVC-Action": "Index", "AspNET-MVC-Controller": "ssssssss", "AspNET-Request-Host": "0.1.0.0", "AspNET-Request-Method": "GET", "AspNET-Request-Url": "http://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/", "IIS-Site-Name": "xxxxxxxxxxxxxxxxxxxxxx", "sgDuration": 203, "sgCategory": "Under1000ms", "CallerMemberName": "LogIfSlowExecution", "CallerFilePath": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "CallerLineNumber": 146 }

This file contain multiple lines with JSONs. Some are loaded properly. Some no. Can help?

My import\_logs.conf:

> input {  
> file {  
> path =\> ["E:/\*\*/log-\*.json"]  
> # start\_position =\> "beginning"  
> sincedb\_path =\> "C:/ProgramData/Elastic/Logstash/file\_track"  
> codec =\> json  
> ignore\_older =\> 7200 # 2 hours  
> max\_open\_files =\> 16000  
> }  
> }
> 
> filter {  
> if [Environment] =~ /^(?i)Production$/ {  
> mutate {  
> add\_field =\> {  
> "Index" =\> "logs-prod-%{+yyyy.MM.dd}"  
> }  
> }  
> } else if [Environment] =~ /^(?i)Testing$/ {  
> mutate {  
> add\_field =\> {  
> "Index" =\> "logs-testing-%{+yyyy.MM.dd}"  
> }  
> }  
> } else {  
> mutate {  
> add\_field =\> {  
> "Index" =\> "logs-dev-%{+yyyy.MM.dd}"  
> }  
> }  
> }
> 
> mutate {  
> remove\_field =\> ["host", "path", "event\_timestamp"]  
> }
> 
> ruby {  
> # handle old NLog configurations where the "exception" (and others) field is ordinary string  
> code =\> "  
> if event.include?('exception') && event.get('exception').is\_a?(String)  
> event.set('exception.json', event.get('exception'))  
> event.remove('exception')  
> end
> 
> ```
> if event.include?('exception.Response') && event.get('exception.Response').is_a?(String)
> event.set('exception.ResponseString', event.get('exception.Response'))
> event.remove(exception.Response)
> end
> 
> if event.include?('exception.State') && event.get('exception.State').is_a?(Numeric)
> event.set('exception.StateNumber', event.get('exception.State'))
> event.remove('exception.State')
> end
>   
> if event.include?('exception.Code') && event.get('exception.Code').is_a?(String)
> event.set('exception.CodeString', event.get('exception.Code'))
> event.remove('exception.Code')
> end
> 
> ```
> 
> if event.include?('exception.Errors.TypeMap.Profile.DefaultMemberConfig.NameMapper.NamedMappers') && event.get('exception.Errors.TypeMap.Profile.DefaultMemberConfig.NameMapper.NamedMappers').is\_a?(String)  
> event.set('exception.Errors.TypeMap.Profile.DefaultMemberConfig.NameMapper.NamedMappersText', event.get('exception.Errors.TypeMap.Profile.DefaultMemberConfig.NameMapper.NamedMappers'))  
> event.remove('exception.Errors.TypeMap.Profile.DefaultMemberConfig.NameMapper.NamedMappers')  
> end  
> "  
> }
> 
> }
> 
> output {  
> stdout { codec =\> rubydebug }
> 
> elasticsearch {  
> id =\> "master\_output"  
> hosts =\> [""]  
> index =\> "%{[Index]}"  
> template =\> "C:/ProgramData/Elastic/Logstash/config/elasticsearch-template-es6x\_doc.json"  
> manage\_template =\> true  
> template\_name =\> "logs"  
> template\_overwrite =\> true  
> }
> 
> }

---

<div class="post-metadata">

**Author:** ![Parry](https://avatars.discourse-cdn.com/v4/letter/p/bbce88/32.png) [@Parry](https://discuss.elastic.co/u/Parry)\
**Post date:** [November 22, 2019, 7:11am UTC](https://discuss.elastic.co/t/problem-with-json/208896/2 "2019-11-22T07:11:09Z")

</div>

Up 🙂

---

<div class="post-metadata">

**Author:** ![Parry](https://avatars.discourse-cdn.com/v4/letter/p/bbce88/32.png) [@Parry](https://discuss.elastic.co/u/Parry)\
**Post date:** [November 26, 2019, 10:49am UTC](https://discuss.elastic.co/t/problem-with-json/208896/3 "2019-11-26T10:49:47Z")

</div>

Up...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 24, 2019, 10:55am UTC](https://discuss.elastic.co/t/problem-with-json/208896/4 "2019-12-24T10:55:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.