[inputs.file] Error in plugin: invalid character ':' after top-level value

[italianoaj]

Hey everyone,

I am trying to use the TICK stack to visualize some log data. Specifically logs from Okta. I pull them down using the Okta API and then I cut down the logs to only the information I want to see. I do all of that in my script here

At the end of all this, I have a file with JSON objects in to that look something like this:

"event":{"user":"John Doe","email_address":"john@gmail.com","ip_address":"8.8.8.8","state":"California","country":"United States","outcome":"SUCCESS","date":"2020-06-16T03:31:01.640Z"}

these are stored in a file at /home/italianoaj/projects/sec/parsed_okta.json

My telegraf.conf file for inputs.file looks like this: ########################################################################## [[inputs.file]] files = ["/home/italianoaj/projects/sec/parsed_okta.json"] data_format = "json" json_name_key = "event" json_string_fields = [ "username", "email_address", "ip_address", "state", "country", "result", "date" ] ###################################################################### When I start telegraf I receive this error: [inputs.file] Error in plugin: invalid character ':' after top-level value

I am using chronograf 1.7.16, influx 1.7.9, kapacitor 1.5.3, telegraf 1.13.0, and ubuntu server 18.04.

Any help would be greatly appreciated. If more information is needed please let me know.

[sanderson]

@italianoaj It doesn't look like your JSON is valid. the "events" key should be inside of a JSON object:

{
    "event": {
        "user": "John Doe",
        "email_address": "john@gmail.com",
        "ip_address": "8.8.8.8",
        "state": "California",
        "country": "United States",
        "outcome": "SUCCESS",
        "date": "2020-06-16T03:31:01.640Z"
    }
}

[italianoaj]

@sanderson Thanks for catching that. I changed the way my JSON is formatted. Now I receive the same error but with "{" instead of ":"

Very odd.

[sanderson]

That is odd. Do you have a link to or sample of the actual JSON file (with sensitive info removed)?

[italianoaj]

@sanderson I appreciate your assistance. I have generated a sample JSON file here

Thanks again for the help.

[sanderson]

That still isn't valid JSON. You can use jsonlint.com to validate your JSON file.

[italianoaj]

@sanderson Thanks for your patience, that resolved the error.

However, how can I be sure the data is coming into influx? I cannot seem to find the right place.

Once again, I appreciate your assistance.

[kelseiv]

Hi @italianoaj, have you tried to Explore your data in Chronograf?

For more assistance, please check out our https://community.influxdata.com or Slack https://influxdata.com/slack. This repo is best for issues on docs.influxdata.com. Thank you!