I'm trying to filter json and add them into fields. Below is my logstash conf code. (I'm using nxlog to import windows event logs to logstash)
When i run the configuration file i'm getting the following error:
Could you paste an example log?
Thank you very much for the reply.
Here you go -
(Everything is in one line)
I spent about a week trying to make this work and it seems that it's not possible to send JSON data reliably using the TCP input. If you send data faster than the TCP nagel setting on your system the TCP input will see 2 JSON messages on a single line and barf on your message. You have no way of knowing if you need to send a comma or not because you do not know if the message will go with another message in the same packet. If you send data faster than a couple a second, this input should not be used.
If you are sending lines of json over tcp, you should use the json_lines codec, not the json codec.
SOrry for the confusion! We're still workign to improve the codecs we have, but for now json_lines should solve your problem.
Was support question, already answered