# Splitting json file
**URL:** https://discuss.elastic.co/t/splitting-json-file/303488
**Category:** Logstash
**Created:** [April 28, 2022, 9:19am UTC](https://discuss.elastic.co/t/splitting-json-file/303488 "2022-04-28T09:19:10Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@javidr](https://discuss.elastic.co/u/javidr)
#### Post date: [April 28, 2022, 9:19am UTC](https://discuss.elastic.co/t/splitting-json-file/303488/1 "2022-04-28T09:19:10Z")
Hi
I am totally new in logstash, and i am having some issues when splitting a json file.
My file is super easy
```auto
{
"data": [
{
"name": "name1"
},
{
"name": "name2"
}
]
}
```
my filter is even easier
```auto
filter {
split { field => "data" }
}
```
However i am having this error message:
Only String and Array types are splittable. field:data is of type = NilClass
Any idea what am i doing wrong?
Thanks
---
### Author:  [@Cad](https://discuss.elastic.co/u/Cad)
#### Post date: [April 28, 2022, 10:01am UTC](https://discuss.elastic.co/t/splitting-json-file/303488/2 "2022-04-28T10:01:52Z")
Hi,
It looks like the data field is not instantiate.
You should use this filter:
```auto
filter {
json {
source => "message"
}
split {
field => "data"
}
}
```
Cad.
---
### Author:  [@javidr](https://discuss.elastic.co/u/javidr)
#### Post date: [April 28, 2022, 11:03am UTC](https://discuss.elastic.co/t/splitting-json-file/303488/3 "2022-04-28T11:03:43Z")
Thanks
I changed that, and it is not doing anything at all now
```auto
input {
file{
path => "/Users/javi/Downloads/logstash-8.1.3/mytest.json"
start_position => "beginning"
sincedb_path => ".sincedb"
}
}
filter {
json {
source => "message"
}
split {
field => "data"
}
}
output {
file {
path => "/Users/javi/Downloads/logstash-8.1.3/testmutated3.json"
}
}
```
This is the last line i have in the console:
[2022-04-28T12:01:48,716][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}
---
### Author:  [@Cad](https://discuss.elastic.co/u/Cad)
#### Post date: [April 28, 2022, 12:55pm UTC](https://discuss.elastic.co/t/splitting-json-file/303488/4 "2022-04-28T12:55:30Z")
> [@javidr](#):
>
> [2022-04-28T12:01:48,716][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}
This is just an information message.
Can you edit your output part like this
```auto
output {
file {
path => "/Users/javi/Downloads/logstash-8.1.3/testmutated3.json"
}
stdout { codec => json }
}
```
And share us what is printed.
Cad
---
### Author:  [@javidr](https://discuss.elastic.co/u/javidr)
#### Post date: [April 28, 2022, 1:43pm UTC](https://discuss.elastic.co/t/splitting-json-file/303488/5 "2022-04-28T13:43:26Z")
Hi
Yes, i know this is the info message, what i mean is that logstash doesnt do anything, it hangs at that point.
I have noticed that this happens when i put the json text in one line. If i format the json file as i pasted in the original post, then, it is when i have the errors. THis is what i have with your output:
```auto
[2022-04-28T14:39:12,215][WARN][logstash.filters.json][main][3fb410f4c4226c62d48f6393d19008a691ac547d52f3b83f0d9a28ff8bd10c39] Error parsing json {:source=>"message", :raw=>" \"data\": [", :exception=>#}
[2022-04-28T14:39:12,219][WARN][logstash.filters.split][main][3b78a77ee766469bb69c5822553d6a87e8c3bb48248d9f2a5fa111408c3d61eb] Only String and Array types are splittable. field:data is of type = NilClass
```
So, my gut feeling is that logstash doesnt like formatted jsons, and this is why i am having the error. But... why is it not doing anything with the one liner?
Have any of you tested this and having the same problem?
---
### Author:  [@javidr](https://discuss.elastic.co/u/javidr)
#### Post date: [April 28, 2022, 2:09pm UTC](https://discuss.elastic.co/t/splitting-json-file/303488/6 "2022-04-28T14:09:29Z")
This is interesting... i changed the output to rubydebug and i have this
Looks like it is parsing (or at least trying) the message, but with a lot of errors. Also it is escaping my json fields ( \ is added to the double quote of the name field)
```auto
{
"tags" => [
[0] "_jsonparsefailure",
[1] "_split_type_failure"
],
"host" => {
"name" => "javi-mac"
},
"@timestamp" => 2022-04-28T14:06:06.822039Z,
"log" => {
"file" => {
"path" => "/Users/javi/Downloads/logstash-8.1.3/mytestjavi3.json"
}
},
"message" => "{",
"@version" => "1"
}
{
"tags" => [
[0] "_split_type_failure"
],
"name" => "name1",
"host" => {
"name" => "javi-mac"
},
"@timestamp" => 2022-04-28T14:06:06.854082Z,
"log" => {
"file" => {
"path" => "/Users/javi/Downloads/logstash-8.1.3/mytestjavi3.json"
}
},
"@version" => "1",
"event" => {
"original" => " {\"name\": \"name1\"},"
}
}
{
"tags" => [
[0] "_jsonparsefailure",
[1] "_split_type_failure"
],
"host" => {
"name" => "javi-mac"
},
"@timestamp" => 2022-04-28T14:06:06.860157Z,
"log" => {
"file" => {
"path" => "/Users/javi/Downloads/logstash-8.1.3/mytestjavi3.json"
}
},
"message" => " ]",
"@version" => "1"
}
{
"tags" => [
[0] "_jsonparsefailure",
[1] "_split_type_failure"
],
"host" => {
"name" => "javi-mac"
},
"@timestamp" => 2022-04-28T14:06:06.845916Z,
"log" => {
"file" => {
"path" => "/Users/javi/Downloads/logstash-8.1.3/mytestjavi3.json"
}
},
"message" => " \"data\": [",
"@version" => "1"
}
{
"tags" => [
[0] "_split_type_failure"
],
"name" => "name2",
"host" => {
"name" => "javi-mac"
},
"@timestamp" => 2022-04-28T14:06:06.857174Z,
"log" => {
"file" => {
"path" => "/Users/javi/Downloads/logstash-8.1.3/mytestjavi3.json"
}
},
"@version" => "1",
"event" => {
"original" => " {\"name\": \"name2\"},"
}
}
```
---
### Author:  [@Cad](https://discuss.elastic.co/u/Cad)
#### Post date: [April 28, 2022, 3:18pm UTC](https://discuss.elastic.co/t/splitting-json-file/303488/7 "2022-04-28T15:18:26Z")
Now it is obvious, it is because you are using the file input plugin.
I you read the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#_description_13) of the file input plugin, it is print
` By default, each event is assumed to be one line and a line is taken to be the text before a newline character. If you would like to join multiple log lines into one event, you’ll want to use the multiline codec.`
So basically the json filter can't process correctly because the file input plugin split the input json when he is well formated in the source file.
So, has it is recommended by the documentation, you have to use the multiline codec to get the entire file content. So you config file need to look like this :
```auto
input {
file{
path => "/Users/javi/Downloads/logstash-8.1.3/mytest.json"
start_position => "beginning"
sincedb_path => ".sincedb"
codec => multiline { # each line not starting with "azertyqwerty" is merged with the previous one.
pattern => "^azertyqwerty"
negate => "true"
what => "previous"
}
}
}
filter {
json {
source => "message"
}
split {
field => "data"
}
}
output {
file {
path => "/Users/javi/Downloads/logstash-8.1.3/testmutated3.json"
}
}
```
> [@javidr](#):
>
> `"message" => " \"data\": ["`
it contains `\` to show that the message field contains a string and this string also contains `"` special character
Cad.
---
### Author:  [@javidr](https://discuss.elastic.co/u/javidr)
#### Post date: [April 28, 2022, 3:33pm UTC](https://discuss.elastic.co/t/splitting-json-file/303488/8 "2022-04-28T15:33:12Z")
Thanks! this starts to make sense
If i change this to a single liner
```auto
{ "data": [{ "name": "name1"},{"name": "name2"}]}
```
it should work without the multiliner codec, isnt it? why is it not working ?
---
### Author:  [@Cad](https://discuss.elastic.co/u/Cad)
#### Post date: [April 28, 2022, 4:00pm UTC](https://discuss.elastic.co/t/splitting-json-file/303488/9 "2022-04-28T16:00:09Z")
> [@javidr](#):
>
> should work without the multiliner codec, isnt it?
Yes
> [@javidr](#):
>
> why is it not working ?
Can you share us the result you get ?
---
### Author:  [@javidr](https://discuss.elastic.co/u/javidr)
#### Post date: [April 29, 2022, 7:58am UTC](https://discuss.elastic.co/t/splitting-json-file/303488/10 "2022-04-29T07:58:55Z")
It doesnt process the file. I have noticed that sometimes if i add an extra blank line at the end or the beginning of the file, it processes it. Its quite weird
---
### Author:  [@Cad](https://discuss.elastic.co/u/Cad)
#### Post date: [April 29, 2022, 8:35am UTC](https://discuss.elastic.co/t/splitting-json-file/303488/11 "2022-04-29T08:35:43Z")
You should read this [Logstash won't read 1 line input file - Elastic Stack / Logstash - Discuss the Elastic Stack](https://discuss.elastic.co/t/logstash-wont-read-1-line-input-file-and-might-miss-last-line-of-data-in-any-file/51855)
Cad.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 27, 2022, 8:35am UTC](https://discuss.elastic.co/t/splitting-json-file/303488/12 "2022-05-27T08:35:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.