I am trying to debug this issue showing up related to Json Parsing. My application is using POCO::Logger for logging which is rotating the log files hourly basis. During the rotation, the Logstash is throwing the below JSON parser error. The error is intermittent.
Looking for any suggestions to debug this issue.
2025-02-07T09:34:56,084][INFO ][filewatch.observingtail ][main][10ca4f1a10e6a3e689ef891f3a3ff879039ceb3fcc641d662b8951f1501fd336] QUIT - closing all files and shutting down.
[2025-02-07T09:34:56,091][INFO ][filewatch.observingtail ][main][10ca4f1a10e6a3e689ef891f3a3ff879039ceb3fcc641d662b8951f1501fd336] START, creating Discoverer, Watch with file and sincedb collections
[2025-02-09T15:30:49,531][WARN ][filewatch.tailmode.processor][main][10ca4f1a10e6a3e689ef891f3a3ff879039ceb3fcc641d662b8951f1501fd336] >>> Rotation In Progress - inode change detected and original content is not fully read, file is closed and path points to new content {:watched_file=>"<FileWatch::WatchedFile: @filename='messages.wti+dlp-wti-1.0.1-7d74f6ccc5-m8v74.20250209153048522', @state=:rotation_in_progress, @recent_states=[:watched, :watched], @bytes_read=0, @bytes_unread=0, current_size=331243, last_stat_size=331243, file_open?=false, @initial=false, sincedb_key='138775837 0 66305'>"}
[2025-02-10T08:18:27,668][ERROR][logstash.codecs.json ][main][d033e3376553f8cb67c84599f1db50929b62ce3fc70e902bb8121847bc541115] JSON parse error, original data now in message field {:message=>"incompatible json object type=java.lang.String , only hash map or arrays are supported", :exception=>LogStash::Json::ParserError, :data=>"\"git_build\":\"4-SNAPSHOT\",\"git_build_time\":\"2025-02-05T08:08:48+0000\"}"}
[2025-02-16T15:08:52,305][ERROR][logstash.codecs.json ][main][d033e3376553f8cb67c84599f1db50929b62ce3fc70e902bb8121847bc541115] JSON parse error, original data now in message field {:message=>"Unrecognized token 'git_build_time': was expecting (JSON String, Number, Array, Object or token 'null', 'true' or 'false')\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 15]", :exception=>LogStash::Json::ParserError, :data=>"git_build_time\":\"2025-01-27T11:17:11+0000\"}"}
where logstash.yaml file is:
file {
path => "/shared/logs/rsk/stats.*"
start_position => "beginning"
sincedb_path => "/shared/logs/.sincedb"
type => "rsk-stats"
stat_interval => 1
discover_interval => 1
#codec => json
}
file {
path => "/shared/logs/dlp2/messages.*"
start_position => "beginning"
sincedb_path => "/shared/logs/.sincedb"
type => "rsk-messages"
stat_interval => 1
discover_interval => 1
#codec => json
}