Hi Akshay, you can use the Logstash split filter to split your message into individual events by splitting by the "data" field.
See https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html for details. If you need more help with Logstash, please post to https://discuss.elastic.co/c/logstash Cheers, Jochen On Monday, 6 February 2017 07:27:45 UTC+1, Akshay Agarwal wrote: > > Hi All, > > Want to implement service request trace using http plugin of logstash in > JSON Array format. > > Getting the following error when trying to parse the JSON array: > > error: > > :message=>"gsub mutation is only applicable for Strings, skipping", > :field=>"message", :value=>nil, :level=>:debug, > :file=>"logstash/filters/mutate.rb", :line=>"322", :method=>"gsub"} > :message=>"Exception in filterworker", > "exception"=>#<LogStash::ConfigurationError: Only String and Array types > are splittable. field:message is of type = NilClass> > > > > My json array is : > > { > "data": [ > { > "appName": "DemoApp", > "appVersion": "1.1", > "deviceId": "1234567", > "deviceName": "moto e", > "deviceOSVersion": "5.1", > "packageName": "com.tcs.DemoApp", > "message": "testing null pointer exception", > "errorLog": "null pointer exception" > }, > { > "appName": "DemoApp", > "appVersion": "1.1", > "deviceId": "1234567", > "deviceName": "moto e", > "deviceOSVersion": "5.1", > "packageName": "com.tcs.DemoApp", > "message": "testing illegal state exception", > "errorLog": "illegal state exception" > } > ] > } > > > > > my logstash config is : > > input { > http { > codec => "json" > } > } > filter{ > json { > source => "message" > } > mutate { gsub => [ "message", "},\r\n\r\n{", "}shr{" ] } > split { > terminator => "shr" > } > } > } > > > output { > stdout { codec => "json" } > gelf{ > host => localhost > facility => "%{type}" > level =>["%{SeverityLevel}", "INFO"] > codec => "json" > } > file{ > path => "/chroot/result.log" > } > } > > > > Any help would be appreciated. > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/59120b27-c002-4737-813f-5a6bec979c9e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
