Skip to content

Instantly share code, notes, and snippets.

@antaflos
Created March 6, 2014 10:12
Show Gist options
  • Save antaflos/9386696 to your computer and use it in GitHub Desktop.
Save antaflos/9386696 to your computer and use it in GitHub Desktop.
Logstash parse failure with TCP input and JSON codec. LS 1.3.3.
input {
log4j {
port => 4560
type => "log4j"
codec => plain { charset => "ISO-8859-1" }
}
tcp {
codec => oldlogstashjson
port => 4561
type => "lsold"
}
tcp {
codec => json
port => 4563
type => "lsnew"
}
tcp {
codec => json_lines
port => 4564
type => "lsnew_nl"
}
}
output {
elasticsearch_http {
host => "eslog01.example.com"
template_overwrite => true
}
}
{
:timestamp=>"2014-03-06T10:53:18.496000+0100",
:message=>"JSON parse failure. Falling back to plain-text",
:error=>#<JSON::ParserError: unexpected token at
'{
"app":"core",
"class":null,
"logger_name":"core",
"file":"parameterset",
"line":172,
"message":"Loaded 2 parameter set release definitions",
"thread":"main",
"hostname":"coredev01.dev.example.at",
"method":"load_releases",
"priority":"INFO",
"ecTxId":null,
"@timestamp":"2014-03-06T10:53:18.492526+01"
}'
>,
:data=>"{\"app\":\"core\",
\"class\":null,
\"logger_name\":\"core\",
\"file\":\"entity\",
\"line\":365,
\"message\":\"ParameterRelease DB load: 2 entries\",
\"thread\":\"main\",
\"hostname\":\"coredev01.dev.example.at\",
\"method\":\"load_from\",
\"priority\":\"DEBUG2\",
\"ecTxId\":null,
\"@timestamp\":\"2014-03-06T10:53:18.492232+01\"}{\"app\":\"core\",
\"class\":null,
\"logger_name\":\"core\",
\"file\":\"parameterset\",
\"line\":172,
\"message\":\"Loaded 2 parameter set release definitions\",
\"thread\":\"main\",
\"hostname\":\"coredev01.dev.example.at\",
\"method\":\"load_releases\",
\"priority\":\"INFO\",
\"ecTxId\":null,
\"@timestamp\":\"2014-03-06T10:53:18.492526+01\"}",
:level=>:info,
:file=>"/opt/logstash/logstash.jar!/logstash/codecs/json.rb",
:line=>"38"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment