# Unable to parse JSON Array object in Logstash

**URL:** https://discuss.elastic.co/t/unable-to-parse-json-array-object-in-logstash/89247
**Category:** Logstash
**Created:** [June 13, 2017, 5:17pm UTC](https://discuss.elastic.co/t/unable-to-parse-json-array-object-in-logstash/89247 "2017-06-13T17:17:15Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 13, 2017, 7:02pm UTC](https://discuss.elastic.co/t/unable-to-parse-json-array-object-in-logstash/89247/2 "2017-06-13T19:02:23Z")

</div>

With that config, you are parsing each line of JSON separately, which does not work. You need a multiline code on the input. Something like

```
input{
        stdin{
                codec => multiline {
                        pattern => "^}"
                        negate => true
                        what => next
                        max_lines => 20000
                }
        }
}

```

Then to parse it the following appears to do what you want

```
filter{
        mutate { gsub => ["message", "\n", ""] }
        json{ source => "message" }
        split{ field => "Records" }
}

```

Lastly I would say that debugging this is much easier with a

```
output{
        stdout{ codec=>"rubydebug" }
}

```

Personally I would add a filter to delete the message field provided the json parse works (i.e. no parse failure tag)

```
    if "_jsonparsefailure" not in [tags] { mutate { remove_field => "message" } }
```

---

_[View the full topic](https://discuss.elastic.co/t/unable-to-parse-json-array-object-in-logstash/89247)._