# Why \_jsonparsefailure?
**URL:** https://discuss.elastic.co/t/why-jsonparsefailure/175448
**Category:** Logstash
**Created:** [April 4, 2019, 3:52pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448 "2019-04-04T15:52:07Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@juandanielpujols](https://discuss.elastic.co/u/juandanielpujols)
#### Post date: [April 4, 2019, 3:52pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448/1 "2019-04-04T15:52:07Z")
Having \_jsonparsefailure, and json parser says messsage is good json.
**I have this configuration file:**
input {
http\_poller {
urls =\> {
url =\> "[https://urlhost:443/remote/core.executeQuery?queryId=###&:output=json](https://urlhost:443/remote/core.executeQuery?queryId=###&:output=json)"
}
cacert =\> "/etc/logstash/conf.d/ssl/trust.pem"
truststore =\> "/etc/logstash/conf.d/ssl/trust.jks"
user =\> "user"
password =\> "xxxxxx"
truststore\_password =\> "xxxxxxx"
schedule =\> { cron =\> "\*/1 \* \* \* \*"}
codec =\> "json"
}
}
filter {
mutate {
gsub =\> [
"message", "^OK:\r\n", ""
]
}
json {
source =\> "message"
}
}
output{
elasticsearch {
manage\_template =\> false
hosts =\> "localhost:9200"
index =\> "indexepo-%{+YYYY.MM.dd}"
}
stdout{}
}
**Message:**
OK:
[{ "EPOLeafNode.LastUpdate" : null, "EPOLeafNode.NodeName" : "x.x.x.x", "EPOComputerProperties.IPV6" : null, "EPOComputerProperties.IsPortable" : -1, "EPOComputerProperties.OSVersion" : "", "EPOComputerProperties.UserName" : "" }, { "EPOLeafNode.LastUpdate" : null, "EPOLeafNode.NodeName" : "x.x.x.x", "EPOComputerProperties.IPV6" : null, "EPOComputerProperties.IsPortable" : -1, "EPOComputerProperties.OSVersion" : "", "EPOComputerProperties.UserName" : "" }, { "EPOLeafNode.LastUpdate" : null, "EPOLeafNode.NodeName" : "pc1", "EPOComputerProperties.IPV6" : null, "EPOComputerProperties.IsPortable" : -1, "EPOComputerProperties.OSVersion" : "", "EPOComputerProperties.UserName" : "" }, { "EPOLeafNode.LastUpdate" : "2019-04-03T07:55:31-04:00", "EPOLeafNode.NodeName" : "pc2", "EPOComputerProperties.IPV6" : "0:0:0:0:0:xxx:xxxx", "EPOComputerProperties.IsPortable" : 0, "EPOComputerProperties.OSVersion" : "6.1", "EPOComputerProperties.UserName" : "User3" }, { "EPOLeafNode.LastUpdate" : "2019-04-03T07:55:31-04:00", "EPOLeafNode.NodeName" : "PC5", "EPOComputerProperties.IPV6" : "0:0:0:0:0:Fxxxxxx", "EPOComputerProperties.IsPortable" : 0, "EPOComputerProperties.OSVersion" : "6.1", "EPOComputerProperties.UserName" : "User7" }]
**Kibana discovery Error:**
April 4th 2019, 11:43:03.522
@timestamp: April 4th 2019, 11:43:03.522
tags: \_jsonparsefailure
@version:1
message: The above message
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 4, 2019, 4:17pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448/2 "2019-04-04T16:17:02Z")
> [@juandanielpujols](#):
>
> [{ "EPOLeafNode.LastUpdate" : null, "EPOLeafNode.NodeName" : "x.x.x.x", "EPOComputerProperties.IPV6" : null, "EPOComputerProperties.IsPortable" : -1, "EPOComputerProperties.OSVersion" : "", "EPOComputerProperties.UserName" : "" },[...] ]
What field do you expect the array to show up in? You need to give the json filter a target option.
Another approach, worse in every way, would be
```
mutate { gsub => ["message", "$", " }", "message", "^", '{ "someName": '] }
```
---
### Author:  [@juandanielpujols](https://discuss.elastic.co/u/juandanielpujols)
#### Post date: [April 4, 2019, 6:05pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448/3 "2019-04-04T18:05:16Z")
Added the target field and work, but still not getting the fields, just the entire message in the new tartget field.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 4, 2019, 6:10pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448/4 "2019-04-04T18:10:16Z")
```
json { source => "message" target => "someField" }
```
gets me
```
"someField" => [
[0] {
"EPOComputerProperties.IsPortable" => -1,
"EPOComputerProperties.IPV6" => nil,
"EPOLeafNode.NodeName" => "x.x.x.x",
"EPOComputerProperties.OSVersion" => "",
"EPOLeafNode.LastUpdate" => nil,
"EPOComputerProperties.UserName" => ""
},
[1] { ...
```
Is that not what you get?
---
### Author:  [@juandanielpujols](https://discuss.elastic.co/u/juandanielpujols)
#### Post date: [April 4, 2019, 6:41pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448/5 "2019-04-04T18:41:25Z")
Yes!!! Right.
But all in the same "someField"
I need all the values separate.
---
### Author:  [@juandanielpujols](https://discuss.elastic.co/u/juandanielpujols)
#### Post date: [April 4, 2019, 6:45pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448/6 "2019-04-04T18:45:19Z")
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 4, 2019, 7:15pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448/7 "2019-04-04T19:15:09Z")
> [@juandanielpujols](#):
>
> I need all the values separate.
Can you be more explicit about what you want? Do you want each entry in the array to be a separate event?
---
### Author:  [@juandanielpujols](https://discuss.elastic.co/u/juandanielpujols)
#### Post date: [April 4, 2019, 7:21pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448/8 "2019-04-04T19:21:02Z")
The whole event is a list in json. Each item on the list is a PC from where i work.
Each pc needs to be in a different row.
Right now they are all in the "evento" field.
Is there anyway to achieve this?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 4, 2019, 7:27pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448/9 "2019-04-04T19:27:51Z")
If you are OK with the fields being nested you could use
```
json { source => "message" target => "someField" remove_field => "message" }
split { field => "someField" }
```
If you want them at the top level then
```
json { source => "message" target => "[@metadata][someField]" remove_field => "message" }
split { field => "[@metadata][someField]" }
ruby { code => 'event.get("[@metadata][someField]").each { |k, v| event.set(k, v) }' }
```
---
### Author:  [@juandanielpujols](https://discuss.elastic.co/u/juandanielpujols)
#### Post date: [April 4, 2019, 8:34pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448/10 "2019-04-04T20:34:10Z")
Thanks a lot! Is working.
Taking some time to index as there are more than 10k values.
Thanks again.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 2, 2019, 8:34pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448/11 "2019-05-02T20:34:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.