# What is wrong with my JSON file? Why this is not being parsed?
**URL:** https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026
**Category:** Logstash
**Created:** [January 5, 2019, 3:23am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026 "2019-01-05T03:23:18Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [January 5, 2019, 3:23am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/1 "2019-01-05T03:23:18Z")
Hi team,
I am writing my logs in json file and and input filter is json directly but those are being parsed correctly in elasticsearch? Any clue what I am missing here?
Here is my json file
```
{"org_name": "google.com", "policy_spf": "pass", "org_email": "noreply-dmarc-support@google.com", "policy_dkim": "pass", "policy_pct": "100", "auth_spf_result": "pass","auth_dkim_domain": "xxx,ccc", "auth_dkim_result": "pass", "identifier_header_from": "xxx,ccc", "date_end": "2019-01-04T05:29:59", "date_start": "2019-01-03T05:30:00", "source_ip": "1,.2.3.4", "count": 1, "auth_spf_domain": "xxx,ccc", "policy_p": "none", "submitter": "unknown", "policy_disposition": "none", "policy_domain": "xxx,ccc", "id": "15325652754200102860"}
```
{"org\_name": "[google.com](http://google.com)", "policy\_spf": "fail", "org\_email": "noreply-dmarc-support@google.com", "policy\_dkim": "fail", "policy\_pct": "100", "auth\_spf\_result": "pass", "identifier\_header\_from": "mail.xxx,ccc", "date\_end": "2019-01-04T05:29:59", "date\_start": "2019-01-03T05:30:00", "source\_ip": "2.3.4.5", "count": 1, "auth\_spf\_domain": "[apc01-hk2-obe.outbound.protection.outlook.com](http://apc01-hk2-obe.outbound.protection.outlook.com)", "policy\_p": "none", "submitter": "unknown", "policy\_disposition": "none", "policy\_domain": "xxx,ccc", "id": "15325652754200102860"}
{"org\_name": "[google.com](http://google.com)", "policy\_spf": "pass", "org\_email": "noreply-dmarc-support@google.com", "policy\_dkim": "pass", "policy\_pct": "100", "auth\_spf\_result": "pass", "auth\_dkim\_domain": "xxx,ccc", "auth\_dkim\_result": "pass", "identifier\_header\_from": "xxx,ccc", "date\_end": "2019-01-04T05:29:59", "date\_start": "2019-01-03T05:30:00", "source\_ip": "2.2.2.2", "count": 1, "auth\_spf\_domain": "xxx,ccc", "policy\_p": "none", "submitter": "unknown", "policy\_disposition": "none", "policy\_domain": "xxx,ccc", "id": "15325652754200102860"}
And here is the config file
```
input {
file {
type => "json"
path => "/log/*.json"
start_position => "beginning"
```
sincedb\_path =\> "/dev/null"
}
}
```
filter {
if [source_type] == "json-logs" {
json {
source => "message"
tag_on_failure => ["_jsonparsefailure"]
}
}
```
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [January 5, 2019, 4:02am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/2 "2019-01-05T04:02:09Z")
Do I need write GROK pattern for my JSON logs? Since those are JSOn should get parsed automatically right?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 5, 2019, 4:43am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/3 "2019-01-05T04:43:11Z")
As far as I can see you do not have a field called ‘source\_type’ so your JSON filter will never run.
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [January 5, 2019, 5:31am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/4 "2019-01-05T05:31:22Z")
hmm so below should work directly right?
```
filter {
json {
source => "message"
tag_on_failure => ["_jsonparsefailure"]
```
}
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 5, 2019, 5:35am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/5 "2019-01-05T05:35:39Z")
You can also use the JSON codec.
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [January 5, 2019, 5:38am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/6 "2019-01-05T05:38:04Z")
As in configuration or suggesting for Json codec plugin?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 5, 2019, 5:39am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/7 "2019-01-05T05:39:58Z")
I think either should work.
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [January 5, 2019, 6:01am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/8 "2019-01-05T06:01:03Z")
I believe by default logstash-codec-json is there..
Any alternative?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 5, 2019, 6:42am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/9 "2019-01-05T06:42:25Z")
You need to use the JSON filter (with correct conditionals) or the JSON codec. Either should work.
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [January 5, 2019, 7:08am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/10 "2019-01-05T07:08:21Z")
Nah man..neither worked!! I would highly appreciate if you could pinpoint the mistake? or which stanza I am wrong?
I mean I tried all the combinations and none of them worked ☹
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 5, 2019, 7:14am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/11 "2019-01-05T07:14:20Z")
This seems to work fine for me so I am not sure what you are doing wrong:
```auto
input {
generator {
lines => ['{"org_name": "google.com", "policy_spf": "fail", "org_email": "noreply-dmarc-support@google.com", "policy_dkim": "fail", "policy_pct": "100", "auth_spf_result": "pass", "identifier_header_from": "mail.xxx,ccc", "date_end": "2019-01-04T05:29:59", "date_start": "2019-01-03T05:30:00", "source_ip": "2.3.4.5", "count": 1, "auth_spf_domain": "apc01-hk2-obe.outbound.protection.outlook.com", "policy_p": "none", "submitter": "unknown", "policy_disposition": "none", "policy_domain": "xxx,ccc", "id": "15325652754200102860"}
{"org_name": "google.com", "policy_spf": "pass", "org_email": "noreply-dmarc-support@google.com", "policy_dkim": "pass", "policy_pct": "100", "auth_spf_result": "pass", "auth_dkim_domain": "xxx,ccc", "auth_dkim_result": "pass", "identifier_header_from": "xxx,ccc", "date_end": "2019-01-04T05:29:59", "date_start": "2019-01-03T05:30:00", "source_ip": "2.2.2.2", "count": 1, "auth_spf_domain": "xxx,ccc", "policy_p": "none", "submitter": "unknown", "policy_disposition": "none", "policy_domain": "xxx,ccc", "id": "15325652754200102860"}']
count => 1
}
}
filter {
json {
source => "message"
}
}
output {
stdout { codec => rubydebug }
}
```
Replace the generator with your input and inspect what is written to stdout.
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [January 5, 2019, 7:45am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/12 "2019-01-05T07:45:27Z")
My Input is just simple
> input {
> file {
> type =\> "json"
> codec =\> json\_lines
> path =\> "/log/\*.json"
> start\_position =\> "beginning"
> sincedb\_path =\> "/dev/null"
> }
And just
> filter {
> json {
> source =\> "message"
> }
> }
Worked?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 5, 2019, 8:43am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/13 "2019-01-05T08:43:59Z")
Try using a JSON codec, not json\_lines, and remove the filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 2, 2019, 8:44am UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-json-file-why-this-is-not-being-parsed/163026/14 "2019-02-02T08:44:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.