Bug in Logstash json filter

Description

I'm trying to filter json and add them into fields. Below is my logstash conf code. (I'm using nxlog to import windows event logs to logstash)

When i run the configuration file i'm getting the following error:

Activity

Show:
Richard Pijnenburg
October 8, 2013, 12:00 PM

Hi,

Could you paste an example log?

Cheers.

Chamara Keragala
October 8, 2013, 12:03 PM
Edited

Thank you very much for the reply.
Here you go -

(Everything is in one line)

Cory Marsh
November 7, 2013, 12:20 AM

I spent about a week trying to make this work and it seems that it's not possible to send JSON data reliably using the TCP input. If you send data faster than the TCP nagel setting on your system the TCP input will see 2 JSON messages on a single line and barf on your message. You have no way of knowing if you need to send a comma or not because you do not know if the message will go with another message in the same packet. If you send data faster than a couple a second, this input should not be used.

Jordan Sissel
November 7, 2013, 1:30 AM

If you are sending lines of json over tcp, you should use the json_lines codec, not the json codec.

SOrry for the confusion! We're still workign to improve the codecs we have, but for now json_lines should solve your problem.

Philippe Weber
June 17, 2014, 7:39 AM

Was support question, already answered

Assignee

Jordan Sissel

Reporter

Chamara Keragala

Affects versions

Configure