Hi Ashkay, I'd recommend starting over with a blank "filter" section in your Logstash configuration and build up on working blocks. For example your "gsub" filter looks just strange.
For further questions about Logstash, please post to https://discuss.elastic.co/c/logstash. Cheers, Jochen On Monday, 6 February 2017 11:48:36 UTC+1, Akshay Agarwal wrote: > > Hi Jochen, > > I had gone through the link that you have provided. > > Previously, I have tried the configuration mentioned in that link. > > But in that as well I was getting the same issue. > > > On Monday, February 6, 2017 at 3:08:27 PM UTC+5:30, Jochen Schalanda wrote: >> >> Hi Akshay, >> >> you can use the Logstash split filter to split your message into >> individual events by splitting by the "data" field. >> >> See >> https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html >> for details. >> >> If you need more help with Logstash, please post to >> https://discuss.elastic.co/c/logstash >> >> Cheers, >> Jochen >> >> On Monday, 6 February 2017 07:27:45 UTC+1, Akshay Agarwal wrote: >>> >>> Hi All, >>> >>> Want to implement service request trace using http plugin of logstash in >>> JSON Array format. >>> >>> Getting the following error when trying to parse the JSON array: >>> >>> error: >>> >>> :message=>"gsub mutation is only applicable for Strings, skipping", >>> :field=>"message", :value=>nil, :level=>:debug, >>> :file=>"logstash/filters/mutate.rb", :line=>"322", :method=>"gsub"} >>> :message=>"Exception in filterworker", >>> "exception"=>#<LogStash::ConfigurationError: Only String and Array types >>> are splittable. field:message is of type = NilClass> >>> >>> >>> >>> My json array is : >>> >>> { >>> "data": [ >>> { >>> "appName": "DemoApp", >>> "appVersion": "1.1", >>> "deviceId": "1234567", >>> "deviceName": "moto e", >>> "deviceOSVersion": "5.1", >>> "packageName": "com.tcs.DemoApp", >>> "message": "testing null pointer exception", >>> "errorLog": "null pointer exception" >>> }, >>> { >>> "appName": "DemoApp", >>> "appVersion": "1.1", >>> "deviceId": "1234567", >>> "deviceName": "moto e", >>> "deviceOSVersion": "5.1", >>> "packageName": "com.tcs.DemoApp", >>> "message": "testing illegal state exception", >>> "errorLog": "illegal state exception" >>> } >>> ] >>> } >>> >>> >>> >>> >>> my logstash config is : >>> >>> input { >>> http { >>> codec => "json" >>> } >>> } >>> filter{ >>> json { >>> source => "message" >>> } >>> mutate { gsub => [ "message", "},\r\n\r\n{", "}shr{" ] } >>> split { >>> terminator => "shr" >>> } >>> } >>> } >>> >>> >>> output { >>> stdout { codec => "json" } >>> gelf{ >>> host => localhost >>> facility => "%{type}" >>> level =>["%{SeverityLevel}", "INFO"] >>> codec => "json" >>> } >>> file{ >>> path => "/chroot/result.log" >>> } >>> } >>> >>> >>> >>> Any help would be appreciated. >>> >>> -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/15c8c50b-b781-4a0b-b07b-4d710a4064df%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
