{"action":"created","issue":{"url":"https://api.github.com/repos/elasticsearch/logstash/issues/2702","labels_url":"https://api.github.com/repos/elasticsearch/logstash/issues/2702/labels{/name}","comments_url":"https://api.github.com/repos/elasticsearch/logstash/issues/2702/comments","events_url":"https://api.github.com/repos/elasticsearch/logstash/issues/2702/events","html_url":"https://github.com/elasticsearch/logstash/issues/2702","id":59157581,"number":2702,"title":"Problem parsing JSON","user":{"login":"alvassin","id":1497444,"avatar_url":"https://avatars.githubusercontent.com/u/1497444?v=3","gravatar_id":"","url":"https://api.github.com/users/alvassin","html_url":"https://github.com/alvassin","followers_url":"https://api.github.com/users/alvassin/followers","following_url":"https://api.github.com/users/alvassin/following{/other_user}","gists_url":"https://api.github.com/users/alvassin/gists{/gist_id}","starred_url":"https://api.github.com/users/alvassin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alvassin/subscriptions","organizations_url":"https://api.github.com/users/alvassin/orgs","repos_url":"https://api.github.com/users/alvassin/repos","events_url":"https://api.github.com/users/alvassin/events{/privacy}","received_events_url":"https://api.github.com/users/alvassin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"talevy","id":388837,"avatar_url":"https://avatars.githubusercontent.com/u/388837?v=3","gravatar_id":"","url":"https://api.github.com/users/talevy","html_url":"https://github.com/talevy","followers_url":"https://api.github.com/users/talevy/followers","following_url":"https://api.github.com/users/talevy/following{/other_user}","gists_url":"https://api.github.com/users/talevy/gists{/gist_id}","starred_url":"https://api.github.com/users/talevy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/talevy/subscriptions","organizations_url":"https://api.github.com/users/talevy/orgs","repos_url":"https://api.github.com/users/talevy/repos","events_url":"https://api.github.com/users/talevy/events{/privacy}","received_events_url":"https://api.github.com/users/talevy/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-02-26T22:48:13Z","updated_at":"2015-02-26T23:06:39Z","closed_at":null,"body":"I have xunit.json file i want to parse & to use its keys as fields names & values as field values.\r\nI tried a couple examples over internet, but anyway i runs to following problem. Could you please assist?\r\n\r\n```\r\nTrouble parsing json {:source=>\"message\", :raw=>\"{\", :exception=>#<JSON::ParserError: A JSON text must at least contain two octets!>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"  \\\"time\\\" : {\", :exception=>#<JSON::ParserError: unexpected token at '\"time\" : {'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"    \\\"start\\\" : 1419621623182,\", :exception=>#<JSON::ParserError: unexpected token at '\"start\" : 1419621623182,'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"    \\\"stop\\\" : 1419621640826,\", :exception=>#<JSON::ParserError: unexpected token at '\"stop\" : 1419621640826,'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"    \\\"duration\\\" : 17644\", :exception=>#<JSON::ParserError: unexpected token at '\"duration\" : 17644'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"  },\", :exception=>#<JSON::ParserError: unexpected token at '},'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"  \\\"testSuites\\\" : [ {\", :exception=>#<JSON::ParserError: unexpected token at '\"testSuites\" : [ {'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"    \\\"uid\\\" : \\\"ac7efb112b3b91cc\\\",\", :exception=>#<JSON::ParserError: unexpected token at '\"uid\" : \"ac7efb112b3b91cc\",'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"    \\\"name\\\" : \\\"tests.buylinks\\\",\", :exception=>#<JSON::ParserError: unexpected token at '\"name\" : \"tests.buylinks\",'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"    \\\"title\\\" : \\\"Buylinks\\\",\", :exception=>#<JSON::ParserError: unexpected token at '\"title\" : \"Buylinks\",'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"    \\\"time\\\" : {\", :exception=>#<JSON::ParserError: unexpected token at '\"time\" : {'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"      \\\"start\\\" : 1419621623182,\", :exception=>#<JSON::ParserError: unexpected token at '\"start\" : 1419621623182,'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"      \\\"stop\\\" : 1419621640826,\", :exception=>#<JSON::ParserError: unexpected token at '\"stop\" : 1419621640826,'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"      \\\"duration\\\" : 17644\", :exception=>#<JSON::ParserError: unexpected token at '\"duration\" : 17644'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"    },\", :exception=>#<JSON::ParserError: unexpected token at '},'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"    \\\"statistic\\\" : {\", :exception=>#<JSON::ParserError: unexpected token at '\"statistic\" : {'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"      \\\"total\\\" : 3,\", :exception=>#<JSON::ParserError: unexpected token at '\"total\" : 3,'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"      \\\"passed\\\" : 0,\", :exception=>#<JSON::ParserError: unexpected token at '\"passed\" : 0,'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"      \\\"pending\\\" : 0,\", :exception=>#<JSON::ParserError: unexpected token at '\"pending\" : 0,'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"      \\\"canceled\\\" : 0,\", :exception=>#<JSON::ParserError: unexpected token at '\"canceled\" : 0,'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"      \\\"failed\\\" : 3,\", :exception=>#<JSON::ParserError: unexpected token at '\"failed\" : 3,'>, :level=>:warn}\r\nTrouble parsing json {:source=>\"message\", :raw=>\"      \\\"broken\\\" : 0\", :exception=>#<JSON::ParserError: unexpected token at '\"broken\" : 0'>, :level=>:warn}\r\n```\r\n\r\nXunit looks like the following:\r\n```json\r\n{\r\n  \"time\" : {\r\n    \"start\" : 1419621623182,\r\n    \"stop\" : 1419621640826,\r\n    \"duration\" : 17644\r\n  },\r\n  \"testSuites\" : [ {\r\n    \"uid\" : \"ac7efb112b3b91cc\",\r\n    \"name\" : \"tests.buylinks\",\r\n    \"title\" : \"Buylinks\",\r\n    \"time\" : {\r\n      \"start\" : 1419621623182,\r\n      \"stop\" : 1419621640826,\r\n      \"duration\" : 17644\r\n    },\r\n    \"statistic\" : {\r\n      \"total\" : 3,\r\n      \"passed\" : 0,\r\n      \"pending\" : 0,\r\n      \"canceled\" : 0,\r\n      \"failed\" : 3,\r\n      \"broken\" : 0\r\n    },\r\n    \"description\" : null,\r\n    \"testCases\" : [ {\r\n      \"uid\" : \"441d1d1dd296fe60\",\r\n      \"name\" : \"test_buylinks\",\r\n      \"title\" : \"Test buylinks\",\r\n      \"time\" : {\r\n        \"start\" : 1419621623182,\r\n        \"stop\" : 1419621640491,\r\n        \"duration\" : 17309\r\n      },\r\n      \"severity\" : \"NORMAL\",\r\n      \"status\" : \"FAILED\"\r\n    }, {\r\n      \"uid\" : \"a88c89b377aca0c9\",\r\n      \"name\" : \"test_buylinks\",\r\n      \"title\" : \"Test buylinks\",\r\n      \"time\" : {\r\n        \"start\" : 1419621623182,\r\n        \"stop\" : 1419621640634,\r\n        \"duration\" : 17452\r\n      },\r\n      \"severity\" : \"NORMAL\",\r\n      \"status\" : \"FAILED\"\r\n    }, {\r\n      \"uid\" : \"32c3f8b52386c85c\",\r\n      \"name\" : \"test_buylinks\",\r\n      \"title\" : \"Test buylinks\",\r\n      \"time\" : {\r\n        \"start\" : 1419621623185,\r\n        \"stop\" : 1419621640826,\r\n        \"duration\" : 17641\r\n      },\r\n      \"severity\" : \"NORMAL\",\r\n      \"status\" : \"FAILED\"\r\n    } ]\r\n  } ]\r\n}\r\n```\r\n\r\nMy config:\r\n```\r\ninput {\r\n  file {\r\n    type => \"testcases\"\r\n    path => [ \"/home/logstash/xunit.json\" ]\r\n    start_position => \"beginning\"\r\n    sincedb_path => \"/home/logstash/sincedb\"\r\n  }\r\n}\r\n\r\nfilter {\r\n  json {\r\n    source => \"message\"\r\n    target => \"doc\"\r\n    add_field => [ \"testsuite\", \"%{[message][testSuites][name]}\" ]\r\n    add_field => [ \"testcase\", \"%{[message][testSuites][testCases][name]}\" ]\r\n  }\r\n}\r\noutput {\r\n  elasticsearch {\r\n    host => \"elasticsearch.dev\"\r\n  }\r\n}\r\n```\r\n\r\nP.S. I am using latest logstash i've downloaded from website 1.4.2."},"comment":{"url":"https://api.github.com/repos/elasticsearch/logstash/issues/comments/76295072","html_url":"https://github.com/elasticsearch/logstash/issues/2702#issuecomment-76295072","issue_url":"https://api.github.com/repos/elasticsearch/logstash/issues/2702","id":76295072,"user":{"login":"talevy","id":388837,"avatar_url":"https://avatars.githubusercontent.com/u/388837?v=3","gravatar_id":"","url":"https://api.github.com/users/talevy","html_url":"https://github.com/talevy","followers_url":"https://api.github.com/users/talevy/followers","following_url":"https://api.github.com/users/talevy/following{/other_user}","gists_url":"https://api.github.com/users/talevy/gists{/gist_id}","starred_url":"https://api.github.com/users/talevy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/talevy/subscriptions","organizations_url":"https://api.github.com/users/talevy/orgs","repos_url":"https://api.github.com/users/talevy/repos","events_url":"https://api.github.com/users/talevy/events{/privacy}","received_events_url":"https://api.github.com/users/talevy/received_events","type":"User","site_admin":false},"created_at":"2015-02-26T23:06:39Z","updated_at":"2015-02-26T23:06:39Z","body":"@alvassin it looks like you are attempting to reference the \"message\" field as the target of your json document during the `add_field` phase. The parsed JSON is placed in the `target` field by the json filter. \r\n\r\nmaybe try:\r\n```\r\nadd_field => [ \"testsuite\", \"%{[doc][testSuites][name]}\" ]\r\nadd_field => [ \"testcase\", \"%{[doc][testSuites][testCases][name]}\" ]\r\n```"}}