# Unable to parse multiline json data into logstash **URL:** \ **Category:** Logstash\ **Created:** [September 13, 2021, 6:36pm UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114 "2021-09-13T18:36:22Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Magesh\_02](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh_02/32/94023_2.png) [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Post date:** [September 13, 2021, 6:36pm UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/1 "2021-09-13T18:36:22Z")
I have tried to parse my json data into logstash data with separate fields. But unable to parse my data, logstash console struck on pipeline starts line input : ```auto { "id": 1, "first_name": "Frank", "last_name": "Mills" } ``` my config is ```auto input { file { codec => multiline { pattern => "^\{" negate => true what => previous auto_flush_interval => 1 max_lines => 2000 } path => ['D:/sample.json'] start_position => "beginning" sincedb_path => "NULL" } } filter { grok { match => { "message" => "^.*?(?{.*)" } } mutate { gsub => ['logged_json', '\n', ''] remove_field => ["message", "@timestamp", "host", "path", "@version", "tags"] } # parse the json and remove the string field upon success json { source => "logged_json" remove_field => ["logged_json"] } } output { stdout { codec => rubydebug } # Sending properly parsed log events to elasticsearch elasticsearch { hosts => ["localhost:9200"] index => "test-metrics437" } } ``` Any help on this? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 13, 2021, 7:16pm UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/2 "2021-09-13T19:16:34Z")
You example file does not have a [in it, so logstash will hang waiting for a line that starts with [. If you use [auto\_flush\_interval](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html#plugins-codecs-multiline-auto_flush_interval) then the codec will flush an event after reading all the non-matching lines and getting a timeout. ---
**Author:** ![Magesh\_02](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh_02/32/94023_2.png) [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Post date:** [September 13, 2021, 10:31pm UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/3 "2021-09-13T22:31:13Z")
Hi @Badger I have updated my config file. please check updated config file, but still it hangs ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a645767ed9e718af4284ecd3962d8890f0c9e9c8.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 13, 2021, 11:00pm UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/4 "2021-09-13T23:00:42Z")
That codec configuration will flush an event when it sees the second line that starts with {. If there is only one object pretty-printed in the file then it will never flush. As I said, use auto\_flush\_interval. ---
**Author:** ![Magesh\_02](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh_02/32/94023_2.png) [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Post date:** [September 13, 2021, 11:01pm UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/5 "2021-09-13T23:01:41Z")
Hi @Badger After using auto flush, i got this error ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6e60e23d21197bfd08f368dcb17e2c82d19239a6.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 13, 2021, 11:03pm UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/6 "2021-09-13T23:03:04Z")
That's not a complete JSON object, so an error is expected. ---
**Author:** ![Magesh\_02](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh_02/32/94023_2.png) [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Post date:** [September 13, 2021, 11:04pm UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/7 "2021-09-13T23:04:54Z")
Hi @Badger No for checking i have precise my input, still it is valid JSON right, how to fix this ---
**Author:** ![Magesh\_02](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh_02/32/94023_2.png) [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Post date:** [September 13, 2021, 11:19pm UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/8 "2021-09-13T23:19:17Z")
Hi @Badger I have checked again, even if we use auto\_flush\_interval also still hangs again. sometimes working if cut and paste input again. dunno what happens here. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 13, 2021, 11:44pm UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/9 "2021-09-13T23:44:24Z")
Just as an FYI, please don't post pictures of text or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them 🙂 ---
**Author:** ![Magesh\_02](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh_02/32/94023_2.png) [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Post date:** [September 15, 2021, 4:42am UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/10 "2021-09-15T04:42:14Z")
Hi @Badger Any update on this. Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 15, 2021, 2:35pm UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/11 "2021-09-15T14:35:20Z")
One thing I notice is that you have `sincedb_path => "NULL"`. That will persist the in-memory sincedb to a file called NULL in the working directory for logstash. It should be "NUL" instead. ---
**Author:** ![Magesh\_02](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh_02/32/94023_2.png) [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Post date:** [September 24, 2021, 6:17am UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/12 "2021-09-24T06:17:09Z")
Ok @Badger i will try this ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 22, 2021, 6:17am UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114/13 "2021-10-22T06:17:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.