有效 JSON 上的 JSON 解析失败答案

【问题标题】：JSON parse failure on valid JSON有效 JSON 上的 JSON 解析失败
【发布时间】：2019-08-31 22:18:02
【问题描述】：

这是我的logstash.conf 文件：

input {
    http {
        host => "127.0.0.1"
        port => 31311 
        ssl => false
    }
}

filter {
    mutate {
        split => { "[headers][request_path]" => "/"}
        add_field => { "index_id" => "%{[headers][request_path][1]}" }
    }

    ruby { 
        code => "event.set('request_path_length', event.get('[headers][request_path]').length)" 
    }

    if [request_path_length] == 3 {
        mutate {
            add_field => { "document_id" => "%{[headers][request_path][2]}" }
        }
    }
}

output {
    stdout {
        codec => "json"
    }

    if [request_path_length] == 3 {
        elasticsearch {
            hosts => "http://localhost:9200"
            index => "%{index_id}"
            document_id => "%{document_id}"
        }
    }
    else {
        elasticsearch {
            hosts => "http://localhost:9200"
            index => "%{index_id}"
        }
    }
}

这是我在 PowerShell 中运行的命令：

PS C:\Users\Me\Downloads\curl-7.64.1-win64-mingw\bin> .\curl.exe -H "content-type:application/json" -XPUT 'http://127.0.0.1:31311/bo
ok/1' -d @"
>> {"IndexId":"Book","DocumentId":"0","Title":"EKQXAQQSZAAUKVLKVHXAB","Edition":1,"Author":{"Name":"Mark Twain","Nationality":"France"},"Pu
blisher":{"Name":"Harper Collins","HeadquartersAddress":{"Country":"Denmark","StreetName":"KRQAQIKTUTMTZ","PostalCode":"4539","State":"WOOS
ESVGWIJDZSZ"}}}
>> "@

这是我在 LogStash 终端中看到的内容：

[2019-04-10T12:36:00,232][ERROR][logstash.codecs.json     ] JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected character ('I' (code 73)): was expecting double-quote to start field name
 at [Source: (String)"{IndexId:Book,DocumentId:0,Title:EKQXAQQSZAAUKVLKVHXAB,Edition:1,Author:{Name:Mark Twain,Nationality:France},Publisher:{Name:Harper Collins,HeadquartersAddress:{Country:Denmark,StreetName:KRQAQIKTUTMTZ,PostalCode:4539,State:WOOSESVGWIJDZSZ}}}"; line: 1, column: 3]>, :data=>"{IndexId:Book,DocumentId:0,Title:EKQXAQQSZAAUKVLKVHXAB,Edition:1,Author:{Name:Mark Twain,Nationality:France},Publisher:{Name:Harper Collins,HeadquartersAddress:{Country:Denmark,StreetName:KRQAQIKTUTMTZ,PostalCode:4539,State:WOOSESVGWIJDZSZ}}}"}
{"message":"{IndexId:Book,DocumentId:0,Title:EKQXAQQSZAAUKVLKVHXAB,Edition:1,Author:{Name:Mark Twain,Nationality:France},Publisher:{Name:Harper Collins,HeadquartersAddress:{Country:Denmark,StreetName:KRQAQIKTUTMTZ,PostalCode:4539,State:WOOSESVGWIJDZSZ}}}","document_id":"1","@version":"1","@timestamp":"2019-04-10T12:36:00.233Z","index_id":"book","request_path_length":3,"tags":["_jsonparsefailure"],"headers":{"content_type":"application/json","request_path":["","book","1"],"http_accept":"*/*","http_version":"HTTP/1.1","content_length":"242","request_method":"PUT","http_user_agent":"curl/7.64.1","http_host":"127.0.0.1:31311"},"host":"127.0.0.1"}

我不确定为什么会出现 JSON 解析失败 - 我的 JSON 样本通过了验证测试 here。

我该如何解决这个问题？

更新：

我运行了一个稍微不同的命令：

PS C:\Users\Me\Downloads\curl-7.64.1-win64-mingw\bin> .\curl.exe -H “内容类型：应用程序/json”-XPUT 'http://127.0.0.1:31311/bo ok/1' -d '{\"IndexId\":\"Book\",\"DocumentId\":\"0\",\"Title\":\"EKQXAQQSZAAUKVLKVHXAB\",\"Edition\":\"1\ ",\"作者\":{\"姓名\":\"标记 Twai n\",\"国籍\":"法国\"},\"出版商\":{\"姓名\":\"哈珀 Collins\",\"HeadquartersAddress\":{\"Country\":\"Denmark\",\"StreetName\":\ "KRQAQIKTUTMTZ\",\"邮政编码\":\"4539\",\"州\":\"WOOSESVGWIJDZSZ\"}}}'

这一次，我在我的 LogStash 终端中看到了这条错误消息：

[2019-04-10T12:53:03,799][ERROR][logstash.codecs.json     ] JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected end-of-input: was expecting closing quote for a string value
 at [Source: (String)"{"IndexId":"Book","DocumentId":"0","Title":"EKQXAQQSZAAUKVLKVHXAB","Edition":"1","Author":{"Name":"Mark"; line: 1, column: 207]>, :data=>"{\"IndexId\":\"Book\",\"DocumentId\":\"0\",\"Title\":\"EKQXAQQSZAAUKVLKVHXAB\",\"Edition\":\"1\",\"Author\":{\"Name\":\"Mark"}
{"message":"{\"IndexId\":\"Book\",\"DocumentId\":\"0\",\"Title\":\"EKQXAQQSZAAUKVLKVHXAB\",\"Edition\":\"1\",\"Author\":{\"Name\":\"Mark","tags":["_jsonparsefailure"],"@version":"1","@timestamp":"2019-04-10T12:53:03.813Z","headers":{"http_version":"HTTP/1.1","http_user_agent":"curl/7.64.1","content_length":"103","request_method":"PUT","http_accept":"*/*","request_path":["","book","1"],"content_type":"application/json","http_host":"127.0.0.1:31311"},"host":"127.0.0.1","index_id":"book","document_id":"1","request_path_length":3}

【问题讨论】：

我认为您的 JSON 周围的双引号有问题

标签： json elasticsearch logstash elasticsearch-plugin

【解决方案1】：

尝试使用：

{\"IndexId\":\"Book\",\"DocumentId\":\"0\",\"Title\":\"EKQXAQQSZAAUKVLKVHXAB\",\"Edition\":\"1\",\"Author\":{\"Name\":\"Mark Twai n\",\"Nationality\":\"France\"},\"Publisher\":{\"Name\":\"Harper Collins\",\"HeadquartersAddress\":{\"Country\":\"Denmark\",\"StreetName\":\"KRQAQIKTUTMTZ\",\"PostalCode\":\"4539\",\"State\":\"WOOSESVGWIJDZSZ\"}}}

注意 France 之前的双引号没有被转义，并且在第一个双引号之前的 StreetName 值中有一个错误的空格。

【讨论】：