- Logstash Reference: other versions:
- Logstash Introduction
- Getting Started with Logstash
- How Logstash Works
- Setting Up and Running Logstash
- Logstash Directory Layout
- Logstash Configuration Files
- logstash.yml
- Secrets keystore for secure settings
- Running Logstash from the Command Line
- Running Logstash as a Service on Debian or RPM
- Running Logstash on Docker
- Configuring Logstash for Docker
- Running Logstash on Kubernetes
- Running Logstash on Windows
- Logging
- Shutting Down Logstash
- Upgrading Logstash
- Creating a Logstash pipeline
- Secure your connection
- Advanced Logstash Configurations
- Logstash-to-Logstash communication
- Managing Logstash
- Using Logstash with Elastic Integrations
- Working with Logstash Modules
- Working with Filebeat Modules
- Working with Winlogbeat Modules
- Queues and data resiliency
- Transforming Data
- Deploying and Scaling Logstash
- Managing GeoIP Databases
- Performance tuning
- Monitoring Logstash with Elastic Agent
- Monitoring Logstash (legacy)
- Monitoring Logstash with APIs
- Working with plugins
- Integration plugins
- Input plugins
- azure_event_hubs
- beats
- cloudwatch
- couchdb_changes
- dead_letter_queue
- elastic_agent
- elastic_serverless_forwarder
- elasticsearch
- exec
- file
- ganglia
- gelf
- generator
- github
- google_cloud_storage
- google_pubsub
- graphite
- heartbeat
- http
- http_poller
- imap
- irc
- java_generator
- java_stdin
- jdbc
- jms
- jmx
- kafka
- kinesis
- logstash
- log4j
- lumberjack
- meetup
- pipe
- puppet_facter
- rabbitmq
- redis
- relp
- rss
- s3
- s3-sns-sqs
- salesforce
- snmp
- snmptrap
- sqlite
- sqs
- stdin
- stomp
- syslog
- tcp
- udp
- unix
- varnishlog
- websocket
- wmi
- xmpp
- Output plugins
- boundary
- circonus
- cloudwatch
- csv
- datadog
- datadog_metrics
- dynatrace
- elastic_app_search
- elastic_workplace_search
- elasticsearch
- exec
- file
- ganglia
- gelf
- google_bigquery
- google_cloud_storage
- google_pubsub
- graphite
- graphtastic
- http
- influxdb
- irc
- java_stdout
- juggernaut
- kafka
- librato
- logstash
- loggly
- lumberjack
- metriccatcher
- mongodb
- nagios
- nagios_nsca
- opentsdb
- pagerduty
- pipe
- rabbitmq
- redis
- redmine
- riak
- riemann
- s3
- sink
- sns
- solr_http
- sqs
- statsd
- stdout
- stomp
- syslog
- tcp
- timber
- udp
- webhdfs
- websocket
- xmpp
- zabbix
- Filter plugins
- age
- aggregate
- alter
- bytes
- cidr
- cipher
- clone
- csv
- date
- de_dot
- dissect
- dns
- drop
- elapsed
- elastic_integration
- elasticsearch
- environment
- extractnumbers
- fingerprint
- geoip
- grok
- http
- i18n
- java_uuid
- jdbc_static
- jdbc_streaming
- json
- json_encode
- kv
- memcached
- metricize
- metrics
- mutate
- prune
- range
- ruby
- sleep
- split
- syslog_pri
- threats_classifier
- throttle
- tld
- translate
- truncate
- urldecode
- useragent
- uuid
- wurfl_device_detection
- xml
- Codec plugins
- Tips and best practices
- Troubleshooting
- Contributing to Logstash
- How to write a Logstash input plugin
- How to write a Logstash codec plugin
- How to write a Logstash filter plugin
- How to write a Logstash output plugin
- Logstash Plugins Community Maintainer Guide
- Document your plugin
- Publish your plugin to RubyGems.org
- List your plugin
- Contributing a patch to a Logstash plugin
- Extending Logstash core
- Contributing a Java Plugin
- Breaking changes
- Release Notes
- Logstash 8.17.1 Release Notes
- Logstash 8.17.0 Release Notes
- Logstash 8.16.2 Release Notes
- Logstash 8.16.1 Release Notes
- Logstash 8.16.0 Release Notes
- Logstash 8.15.5 Release Notes
- Logstash 8.15.4 Release Notes
- Logstash 8.15.3 Release Notes
- Logstash 8.15.2 Release Notes
- Logstash 8.15.1 Release Notes
- Logstash 8.15.0 Release Notes
- Logstash 8.14.3 Release Notes
- Logstash 8.14.2 Release Notes
- Logstash 8.14.1 Release Notes
- Logstash 8.14.0 Release Notes
- Logstash 8.13.4 Release Notes
- Logstash 8.13.3 Release Notes
- Logstash 8.13.2 Release Notes
- Logstash 8.13.1 Release Notes
- Logstash 8.13.0 Release Notes
- Logstash 8.12.2 Release Notes
- Logstash 8.12.1 Release Notes
- Logstash 8.12.0 Release Notes
- Logstash 8.11.4 Release Notes
- Logstash 8.11.3 Release Notes
- Logstash 8.11.2 Release Notes
- Logstash 8.11.1 Release Notes
- Logstash 8.11.0 Release Notes
- Logstash 8.10.4 Release Notes
- Logstash 8.10.3 Release Notes
- Logstash 8.10.2 Release Notes
- Logstash 8.10.1 Release Notes
- Logstash 8.10.0 Release Notes
- Logstash 8.9.2 Release Notes
- Logstash 8.9.1 Release Notes
- Logstash 8.9.0 Release Notes
- Logstash 8.8.2 Release Notes
- Logstash 8.8.1 Release Notes
- Logstash 8.8.0 Release Notes
- Logstash 8.7.1 Release Notes
- Logstash 8.7.0 Release Notes
- Logstash 8.6.2 Release Notes
- Logstash 8.6.1 Release Notes
- Logstash 8.6.0 Release Notes
- Logstash 8.5.3 Release Notes
- Logstash 8.5.2 Release Notes
- Logstash 8.5.1 Release Notes
- Logstash 8.5.0 Release Notes
- Logstash 8.4.2 Release Notes
- Logstash 8.4.1 Release Notes
- Logstash 8.4.0 Release Notes
- Logstash 8.3.3 Release Notes
- Logstash 8.3.2 Release Notes
- Logstash 8.3.1 Release Notes
- Logstash 8.3.0 Release Notes
- Logstash 8.2.3 Release Notes
- Logstash 8.2.2 Release Notes
- Logstash 8.2.1 Release Notes
- Logstash 8.2.0 Release Notes
- Logstash 8.1.3 Release Notes
- Logstash 8.1.2 Release Notes
- Logstash 8.1.1 Release Notes
- Logstash 8.1.0 Release Notes
- Logstash 8.0.1 Release Notes
- Logstash 8.0.0 Release Notes
- Logstash 8.0.0-rc2 Release Notes
- Logstash 8.0.0-rc1 Release Notes
- Logstash 8.0.0-beta1 Release Notes
- Logstash 8.0.0-alpha2 Release Notes
- Logstash 8.0.0-alpha1 Release Notes
Json codec plugin
editJson codec plugin
edit- Plugin version: v3.1.1
- Released on: 2022-10-03
- Changelog
For other versions, see the Versioned plugin docs.
Getting help
editFor questions about the plugin, open a topic in the Discuss forums. For bugs or feature requests, open an issue in Github. For the list of Elastic supported plugins, please consult the Elastic Support Matrix.
Description
editThis codec may be used to decode (via inputs) and encode (via outputs) full JSON messages. If the data being sent is a JSON array at its root multiple events will be created (one per element).
If you are streaming JSON messages delimited
by \n then see the json_lines
codec.
Encoding will result in a compact JSON representation (no line terminators or indentation)
If this codec recieves a payload from an input that is not valid JSON, then
it will fall back to plain text and add a tag _jsonparsefailure
. Upon a JSON
failure, the payload will be stored in the message
field.
Json Codec Configuration Options
editSetting | Input type | Required |
---|---|---|
string, one of |
No |
|
No |
||
No |
charset
edit-
Value can be any of:
ASCII-8BIT
,UTF-8
,US-ASCII
,Big5
,Big5-HKSCS
,Big5-UAO
,CP949
,Emacs-Mule
,EUC-JP
,EUC-KR
,EUC-TW
,GB2312
,GB18030
,GBK
,ISO-8859-1
,ISO-8859-2
,ISO-8859-3
,ISO-8859-4
,ISO-8859-5
,ISO-8859-6
,ISO-8859-7
,ISO-8859-8
,ISO-8859-9
,ISO-8859-10
,ISO-8859-11
,ISO-8859-13
,ISO-8859-14
,ISO-8859-15
,ISO-8859-16
,KOI8-R
,KOI8-U
,Shift_JIS
,UTF-16BE
,UTF-16LE
,UTF-32BE
,UTF-32LE
,Windows-31J
,Windows-1250
,Windows-1251
,Windows-1252
,IBM437
,IBM737
,IBM775
,CP850
,IBM852
,CP852
,IBM855
,CP855
,IBM857
,IBM860
,IBM861
,IBM862
,IBM863
,IBM864
,IBM865
,IBM866
,IBM869
,Windows-1258
,GB1988
,macCentEuro
,macCroatian
,macCyrillic
,macGreek
,macIceland
,macRoman
,macRomania
,macThai
,macTurkish
,macUkraine
,CP950
,CP951
,IBM037
,stateless-ISO-2022-JP
,eucJP-ms
,CP51932
,EUC-JIS-2004
,GB12345
,ISO-2022-JP
,ISO-2022-JP-2
,CP50220
,CP50221
,Windows-1256
,Windows-1253
,Windows-1255
,Windows-1254
,TIS-620
,Windows-874
,Windows-1257
,MacJapanese
,UTF-7
,UTF8-MAC
,UTF-16
,UTF-32
,UTF8-DoCoMo
,SJIS-DoCoMo
,UTF8-KDDI
,SJIS-KDDI
,ISO-2022-JP-KDDI
,stateless-ISO-2022-JP-KDDI
,UTF8-SoftBank
,SJIS-SoftBank
,BINARY
,CP437
,CP737
,CP775
,IBM850
,CP857
,CP860
,CP861
,CP862
,CP863
,CP864
,CP865
,CP866
,CP869
,CP1258
,Big5-HKSCS:2008
,ebcdic-cp-us
,eucJP
,euc-jp-ms
,EUC-JISX0213
,eucKR
,eucTW
,EUC-CN
,eucCN
,CP936
,ISO2022-JP
,ISO2022-JP2
,ISO8859-1
,ISO8859-2
,ISO8859-3
,ISO8859-4
,ISO8859-5
,ISO8859-6
,CP1256
,ISO8859-7
,CP1253
,ISO8859-8
,CP1255
,ISO8859-9
,CP1254
,ISO8859-10
,ISO8859-11
,CP874
,ISO8859-13
,CP1257
,ISO8859-14
,ISO8859-15
,ISO8859-16
,CP878
,MacJapan
,ASCII
,ANSI_X3.4-1968
,646
,CP65000
,CP65001
,UTF-8-MAC
,UTF-8-HFS
,UCS-2BE
,UCS-4BE
,UCS-4LE
,CP932
,csWindows31J
,SJIS
,PCK
,CP1250
,CP1251
,CP1252
,external
,locale
-
Default value is
"UTF-8"
The character encoding used in this codec. Examples include "UTF-8" and "CP1252".
JSON requires valid UTF-8 strings, but in some cases, software that
emits JSON does so in another encoding (nxlog, for example). In
weird cases like this, you can set the charset
setting to the
actual encoding of the text and Logstash will convert it for you.
For nxlog users, you may to set this to "CP1252".
ecs_compatibility
edit- Value type is string
-
Supported values are:
-
disabled
: JSON document data added at root level -
v1
,v8
: Elastic Common Schema compliant behavior (warns whentarget
isn’t set)
-
-
Default value depends on which version of Logstash is running:
-
When Logstash provides a
pipeline.ecs_compatibility
setting, its value is used as the default -
Otherwise, the default value is
disabled
-
When Logstash provides a
Controls this plugin’s compatibility with the Elastic Common Schema (ECS).
target
edit- Value type is string
- There is no default value for this setting.
Define the target field for placing the parsed data. If this setting is not set, the JSON data will be stored at the root (top level) of the event.
For example, if you want data to be put under the document
field:
input { http { codec => json { target => "[document]" } } }
ElasticON events are back!
Learn about the Elastic Search AI Platform from the experts at our live events.
Register now