Hi Ashkay, I'd recommend starting over with a blank "filter" section in your Logstash configuration and build up on working blocks. For example your "gsub" filter looks just strange.
For further questions about Logstash, please post to https://discuss.elastic.co/c/logstash. Cheers, Jochen On Monday, 6 February 2017 11:48:36 UTC+1, Akshay Agarwal wrote: > > Hi Jochen, > > I had gone through the link that you have provided. > > Previously, I have tried the configuration mentioned in that link. > > But in that as well I was getting the same issue. > > > On Monday, February 6, 2017 at 3:08:27 PM UTC+5:30, Jochen Schalanda wrote: >> >> Hi Akshay, >> >> you can use the Logstash split filter to split your message into >> individual events by splitting by the "data" field. >> >> See >> https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html >> for details. >> >> If you need more help with Logstash, please post to >> https://discuss.elastic.co/c/logstash >> >> Cheers, >> Jochen >> >> On Monday, 6 February 2017 07:27:45 UTC+1, Akshay Agarwal wrote: >>> >>> Hi All, >>> >>> Want to implement service request trace using http plugin of logstash in >>> JSON Array format. >>> >>> Getting the following error when trying to parse the JSON array: >>> >>> error: >>> >>> :message=>"gsub mutation is only applicable for Strings, skipping", >>> :field=>"message", :value=>nil, :level=>:debug, >>> :file=>"logstash/filters/mutate.rb", :line=>"322", :method=>"gsub"} >>> :message=>"Exception in filterworker", >>> "exception"=>#<LogStash::ConfigurationError: Only String and Array types >>> are splittable. field:message is of type = NilClass> >>> >>> >>> >>> My json array is : >>> >>> { >>> "data": [ >>> { >>> "appName": "DemoApp", >>> "appVersion": "1.1", >>> "deviceId": "1234567", >>> "deviceName": "moto e", >>> "deviceOSVersion": "5.1", >>> "packageName": "com.tcs.DemoApp", >>> "message": "testing null pointer exception", >>> "errorLog": "null pointer exception" >>> }, >>> { >>> "appName": "DemoApp", >>> "appVersion": "1.1", >>> "deviceId": "1234567", >>> "deviceName": "moto e", >>> "deviceOSVersion": "5.1", >>> "packageName": "com.tcs.DemoApp", >>> "message": "testing illegal state exception", >>> "errorLog": "illegal state exception" >>> } >>> ] >>> } >>> >>> >>> >>> >>> my logstash config is : >>> >>> input { >>> http { >>> codec => "json" >>> } >>> } >>> filter{ >>> json { >>> source => "message" >>> } >>> mutate { gsub => [ "message", "},\r\n\r\n{", "}shr{" ] } >>> split { >>> terminator => "shr" >>> } >>> } >>> } >>> >>> >>> output { >>> stdout { codec => "json" } >>> gelf{ >>> host => localhost >>> facility => "%{type}" >>> level =>["%{SeverityLevel}", "INFO"] >>> codec => "json" >>> } >>> file{ >>> path => "/chroot/result.log" >>> } >>> } >>> >>> >>> >>> Any help would be appreciated. >>> >>> -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/15c8c50b-b781-4a0b-b07b-4d710a4064df%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
