How do I input a json file to logstash

Asked Oct 04 '22 at 13:48

Active Oct 04 '22 at 14:02

Viewed 329 times

I have the following file.json

{"event":"send_message","id":"9ee9295e-1c11-41be-8e8c-219688f0c770","type":"link","channel_number":"5735565091","steps":[{"step1":"verify_queue","timestamp1":1664829652,"step2":"send_to_route","timestamp2":1664829680,"step3":"wait_for_confirmation","timestamp3":1664829690,"step4":"remove_from_queue","timestamp4":1664829718}],"number_of_tries":1,"status":true}
{"event":"send_message","id":"daa0acda-3924-42ca-b8d1-0aa384eb9a27","type":"text","channel_number":"5591594463","steps":[{"step1":"verify_queue","timestamp1":1664829653,"step2":"send_to_route","timestamp2":1664829713,"step3":"wait_for_confirmation","timestamp3":1664829741,"step4":"remove_from_queue","timestamp4":1664829769}],"number_of_tries":6,"status":true}

I'm trying to upload to elastic via logstash but my index (already created) won't update

here's my logstash config

input {
  file {
    type => "json"
    path => "/home/user/logs/file.json"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    codec => "json"
  }
}

filter {
  json {
    source => "message"
  }
}

output {

  elasticsearch{
        hosts => ["elasticsearch:9200"]
        user => elastic
        password => changeme
        index => "testando"
        document_type => "json"
    }
}

What am I doing wrong? I'm using elk-docker

edited Oct 04 '22 at 14:02

asked Oct 04 '22 at 13:48

Arthur Breguez

Can you add an `stdout{}` output in the output section to see what actually flies out of Logstash? – Val Oct 04 '22 at 13:56
i tried that, it won't output anything related to the logs – Arthur Breguez Oct 04 '22 at 14:10
Are you sure the file file.json is indeed in the docker container of the logstash ? – Paulo Oct 04 '22 at 14:28
Also, you do not need both a json codec and a json filter. – Badger Oct 04 '22 at 15:04
I forgot to set the host volume on docker compose file, now it works fine, thanks! About the coded and filter, which one is the best to this case? – Arthur Breguez Oct 04 '22 at 16:28

How do I input a json file to logstash

0 Answers0