I am trying to log data from Varnish, which can be coerced into producing a JSON log file. When I import this using Filebeat, I'm getting a json_error of Error decoding JSON: invalid character '}' looking for beginning of object key string An example of a log line is: {"message": {"remoteHost": …

I discovered I was using a bad @timestamp format, so I've fixed it here. Apologies for the insane amount of quote escaping, that's to do with how VarnishNCSA is configured :slight_smile: format="\"{\\\"remoteHost\\\": \\\"%h\\\",\\\"remoteUser\\\": \\\"%u\\\",\\\"@timestamp\\\": \\\"%{%Y-%m-%dT%TZ}…

Cylindric (Mark Hanford) March 1, 2017, 9:27am 5

Oh yes, I forgot about that. I'll post the answer in there.

Topic		Replies	Views
Nginx json logs + filebeat + elasticsearch but unwanted key: value order Beats filebeat	3	4044	February 1, 2017
Filebeat not ingesting JSON Beats filebeat	3	776	July 11, 2019
Filebeat JSON message Beats	3	5198	November 24, 2017
Filebeat getting error when parsing json Beats filebeat	1	290	April 9, 2021
Json data from Filebeat to Logstash Logstash	5	674	February 5, 2023

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Trying to work out the expected JSON format for Varnish logging

Related topics