# Read JSON from a static file

**URL:** <https://discuss.elastic.co/t/read-json-from-a-static-file/164442>\
**Category:** Logstash\
**Created:** [January 16, 2019, 10:45am UTC](https://discuss.elastic.co/t/read-json-from-a-static-file/164442 "2019-01-16T10:45:05Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrashid](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@mrashid](https://discuss.elastic.co/u/mrashid)\
**Post date:** [January 16, 2019, 10:45am UTC](https://discuss.elastic.co/t/read-json-from-a-static-file/164442/1 "2019-01-16T10:45:05Z")

</div>

I have a JSON file by name "output.json" which has only one entry --

> CI ID : 213

I am trying to read from the json file using the below logstash configuration **using input file plugin**. My aim is to include the content of the JSON file and append to every document entry that i receive from filebeat. The contents of the JSON file is dynamic and changes once per day.

> input {  
> beats {  
> port =\> 5044  
> ssl =\> true  
> ssl\_certificate =\> "/security/logstash.crt"  
> ssl\_key =\> "/security/logstash.key"  
> }  
> file {  
> path =\> ["/etc/logstash/output.json"]  
> start\_position =\> "beginning"  
> sincedb\_path =\> "/dev/null"  
> codec =\> "json"  
> }  
> }  
> filter {  
> grok {  
> match =\> { "message" =\> "^The build ID of the run is : %{NUMBER:filteredValues}" }  
> }  
> }

**Note :** I have already deleted the .sincedb file and tried to execute the above configuration. But no luck.

**My Question : any idea on how to read from a static JSON file and append the content of the json to every document entry into logstash ??**

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 16, 2019, 4:09pm UTC](https://discuss.elastic.co/t/read-json-from-a-static-file/164442/2 "2019-01-16T16:09:25Z")

</div>

You could do it using

```
ruby {
    init => "
        file = File.read('/tmp/foo.json')
        h = JSON.parse(file)
        @CIID = h['CIID']
    "
    code => '
        event.set("CIID", @CIID)
    '
}

```

Error handling left as an exercise for the reader.

---

<div class="post-metadata">

**Author:** ![mrashid](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@mrashid](https://discuss.elastic.co/u/mrashid)\
**Post date:** [January 17, 2019, 12:40pm UTC](https://discuss.elastic.co/t/read-json-from-a-static-file/164442/3 "2019-01-17T12:40:16Z")

</div>

@Badger Thank you for responding back. your input has been very helpful. However , I ran into unusual issues -

Firstly,  
My "output.json" was corrupt.Here is how I am feeding data to output.json-

> output {  
> if [filteredValues] {  
> file {  
> path =\> "/etc/logstash/output.json"  
> codec =\> json { format =\> "CI-ID : %{filteredValues}"}  
> write\_behavior =\> overwrite  
> }  
> }

**I get the following error if I use JSON codec -**

> "LogStash::ConfigurationError", :message=\>"Something is wrong with your configuration.",

If I change the contents in the output.json to the below , your ruby code works -

> {  
> "CIID": "232"  
> }

**ISSUE :** The file output plugin is not able to write json data to the output.json file.

**What I have done -**

I have changed the codec to line and here is my configuration -

> output {  
> if [filteredValues] {  
> file {  
> path =\> "/etc/logstash/output.txt"  
> codec =\> **line** { format =\> "CI-ID : %{filteredValues}"}  
> write\_behavior =\> overwrite  
> }  
> }

and here is the ruby to copy from the output.txt and write to a new field -

> filter {  
> ruby {  
> init =\> "file = '/etc/logstash/output.json'  
> @CIID = File.readlines(file).each do |line|  
> puts line  
> end"
> 
> ```
> code => 'event.set("CI-ID", @CIID)'
> 
> ```
> 
> }  
> }

**The above configuration works perfect. However , the problem is that The ruby code is not able to fetch the latest value from the "output.txt" file (_even though the output.txt holds an updated value_).  
I am required to restart ELK , for the ruby to fetch the latest value from the "output.txt" . If I dont restart ELK , the ruby code is fetching me the first value (i.e something like this - "CI-ID : 237") that the "output.txt " was holding after the first ELK restart.**

Any idea what i am doing wrong ? Am I not closing the file somewhere ??

@magnusbaeck any opinion that you would like to give here ?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 17, 2019, 1:37pm UTC](https://discuss.elastic.co/t/read-json-from-a-static-file/164442/4 "2019-01-17T13:37:23Z")

</div>

> [@mrashid](#):
>
> Something is wrong with your configuration

There should be another error message output after this. The configuration you show is missing a }.

The whole point of "init =\>" is to do something once when logstash starts. If you want to read the file every time an event is processed you could move that code to the "code =\>" block.

---

<div class="post-metadata">

**Author:** ![mrashid](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@mrashid](https://discuss.elastic.co/u/mrashid)\
**Post date:** [January 17, 2019, 7:41pm UTC](https://discuss.elastic.co/t/read-json-from-a-static-file/164442/5 "2019-01-17T19:41:25Z")

</div>

@Badger

Thank you for responding back. I have moved the code to "code=\>" block and everything is working fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2019, 7:55pm UTC](https://discuss.elastic.co/t/read-json-from-a-static-file/164442/6 "2019-02-14T19:55:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.