Parse JSON logs in Logstash

Use a JSON codec when each input event is already a complete JSON payload. Use the JSON filter when JSON is stored inside an event field or must first be separated from a text prefix. Avoid decoding the same payload twice.

Decode one JSON object per line

A file containing newline-delimited JSON can use this input:

input {
  file {
    path => "/var/log/mylogs.log"
    start_position => "beginning"
    codec => json { target => "[app]" }
  }
}

For example:

{"status":200,"ip":"127.0.0.1","level":30,"msg":"Connected to database","timestamp":1696150204}

The object is placed under app, keeping application fields separate from Logstash metadata. Without target, the codec places them at the root. start_position affects first contact with a file; an existing sincedb position still takes precedence.

Use the JSON codec for this line-oriented file input rather than assuming json_lines is interchangeable: the file input already separates records. Pretty-printed multi-line objects need appropriate event framing first.

Parse JSON held in a field

For an event whose message contains JSON, use this alternative:

filter {
  json {
    source => "message"
    target => "[app]"
  }
  if "_jsonparsefailure" not in [tags] {
    if [app][timestamp] {
      date { match => ["[app][timestamp]", "UNIX"] }
    }
    mutate { convert => { "[app][status]" => "integer" } }
  }
}

For the codec approach, use just the date and mutate operations after decoding. UNIX interprets seconds; use UNIX_MS for milliseconds. Nested JSON objects remain nested and can be referenced as [app][parent][child].

Handle failures explicitly

The JSON filter normally tags invalid JSON with _jsonparsefailure and leaves the original event available. The JSON codec falls back to a message containing the payload and adds the same tag. Neither behavior alone guarantees that a later filter or output will retain the event: route failures deliberately and inspect them before removing raw data.

If a line contains a text prefix followed by JSON, extract the JSON substring into a dedicated field with Grok or another suitable parser, then point source at that field. Test braces inside quoted strings and escaped characters rather than using a simplistic split that truncates valid JSON.

References: JSON codec and JSON filter.