PH22677: Logstash error when parsing json

APAR status

• Closed as program error.

Error description

• When logstash tries to parse the logs from Liberty, there is
  a parsing error because of incorrect formatting of the json
  logs.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server Liberty using logstashCollector in   *
  *                  20.0.0.2                                    *
  ****************************************************************
  * PROBLEM DESCRIPTION: Missing JSON in log event causes a      *
  *                      Logstash parsing error                  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  A Logstash parsing error occurs because the JSON log event
  created is missing the expected JSON for the first field name
  "type". The specific JSON that is missing is: \"type
  The error looks something like:
  [WARN ][logstash.filters.json    ] Error parsing json
  {:source=>"message",
  :raw=>"{\":\"liberty_accesslog\",\"hostName\":\"e075473cc673\",
  ...
  

Problem conclusion

• The missing JSON was added back into the log event during
  creation.
  
  The fix for this APAR is currently targeted for inclusion in fix
  pack 20.0.0.3.  Please refer to the Recommended Updates page for
  delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  LIBERTY PROFILE

• Fixed component ID

  5724J0814

Applicable component levels