Note that there are some explanatory texts on larger screens.

plurals
  1. POjson filter fails with >#<NoMethodError: undefined method `[]' for nil:NilClass>
    primarykey
    data
    text
    <p>I'm trying to process entries from a logfile that contains both plain messages and json formatted messages. My initial idea was to grep for messages enclosed in curly braces and have them processed by another chained filter. Grep works fine (as does plain message processing), but the subsequent json filter reports an exception. I attached the logstash configuration, input and error message below.</p> <p>Do you have any ideas what the problem might be? Any alternative suggestions for processing plain and json formatted entries from the same file?</p> <p>Thanks a lot, Johannes</p> <p>Error message:</p> <pre><code>Trouble parsing json {:key=&gt;"@message", :raw=&gt;"{\"time\":\"14.08.2013 10:16:31:799\",\"level\":\"DEBUG\",\"thread\":\"main\",\"clazz\":\"org.springframework.beans.factory.support.DefaultListableBeanFactory\",\"line\":\"214\",\"msg\":\"Returning cached instance of singleton bean 'org.apache.activemq.xbean.XBeanBrokerService#0'\"}", :exception=&gt;#&lt;NoMethodError: undefined method `[]' for nil:NilClass&gt;, :level=&gt;:warn} </code></pre> <p>logstash conf:</p> <pre><code>file { path =&gt; [ "plain.log" ] type =&gt; "plainlog" format =&gt; "plain" } } filter { # Grep json formatted messages and send them to following json filter grep { type =&gt; "plainlog" add_tag =&gt; [ "grepped_json" ] match =&gt; [ "@message", "^{.*}" ] } json { tags =&gt; [ "grepped_json" ] source =&gt; "@message" } } output { stdout { debug =&gt; true debug_format =&gt; "json"} elasticsearch { embedded =&gt; true } } </code></pre> <p>Input from logfile (just one line):</p> <pre><code>{"time":"14.08.2013 10:16:31:799","level":"DEBUG","thread":"main","clazz":"org.springframework.beans.factory.support.DefaultListableBeanFactory","line":"214","msg":"Returning cached instance of singleton bean 'org.apache.activemq.xbean.XBeanBrokerService#0'"} </code></pre>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload