Hi Jochen, I had gone through the link that you have provided.
Previously, I have tried the configuration mentioned in that link. But in that as well I was getting the same issue. On Monday, February 6, 2017 at 3:08:27 PM UTC+5:30, Jochen Schalanda wrote: > > Hi Akshay, > > you can use the Logstash split filter to split your message into > individual events by splitting by the "data" field. > > See > https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html > for details. > > If you need more help with Logstash, please post to > https://discuss.elastic.co/c/logstash > > Cheers, > Jochen > > On Monday, 6 February 2017 07:27:45 UTC+1, Akshay Agarwal wrote: >> >> Hi All, >> >> Want to implement service request trace using http plugin of logstash in >> JSON Array format. >> >> Getting the following error when trying to parse the JSON array: >> >> error: >> >> :message=>"gsub mutation is only applicable for Strings, skipping", >> :field=>"message", :value=>nil, :level=>:debug, >> :file=>"logstash/filters/mutate.rb", :line=>"322", :method=>"gsub"} >> :message=>"Exception in filterworker", >> "exception"=>#<LogStash::ConfigurationError: Only String and Array types >> are splittable. field:message is of type = NilClass> >> >> >> >> My json array is : >> >> { >> "data": [ >> { >> "appName": "DemoApp", >> "appVersion": "1.1", >> "deviceId": "1234567", >> "deviceName": "moto e", >> "deviceOSVersion": "5.1", >> "packageName": "com.tcs.DemoApp", >> "message": "testing null pointer exception", >> "errorLog": "null pointer exception" >> }, >> { >> "appName": "DemoApp", >> "appVersion": "1.1", >> "deviceId": "1234567", >> "deviceName": "moto e", >> "deviceOSVersion": "5.1", >> "packageName": "com.tcs.DemoApp", >> "message": "testing illegal state exception", >> "errorLog": "illegal state exception" >> } >> ] >> } >> >> >> >> >> my logstash config is : >> >> input { >> http { >> codec => "json" >> } >> } >> filter{ >> json { >> source => "message" >> } >> mutate { gsub => [ "message", "},\r\n\r\n{", "}shr{" ] } >> split { >> terminator => "shr" >> } >> } >> } >> >> >> output { >> stdout { codec => "json" } >> gelf{ >> host => localhost >> facility => "%{type}" >> level =>["%{SeverityLevel}", "INFO"] >> codec => "json" >> } >> file{ >> path => "/chroot/result.log" >> } >> } >> >> >> >> Any help would be appreciated. >> >> -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/60c286d8-2fbd-4c38-8d39-3beed83291bf%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
