What is a JSON object?

Elastic Stack Beats
1

Hi everyone,

Sorry to ask a very basic question. At first, I'm trying to find a way to parse a JSON log in filebeat with container input type. Then I found this documentation. in the description, it said it only works if there is 1 json object per line

Filebeat processes the logs line by line, so the JSON decoding only works if there is one JSON object per line.

so I ended up with a question, "What is a JSON object?" After doing some research, I found out that JSON object is determined by curly braces {}. If so, what are Bio and place called in this example?

{"Bio":{"male":{"name":"trou"}},"place":{"live":"city"}}

I thought Bio and place were a JSON object all this time

I really appreciate your explanation.

thank you

2

Both are members in the json object, a pair of names and values. [rfc definition]

A json object starts with { and ends with }, in this case your json object is:

{"Bio":{"male":{"name":"trou"}},"place":{"live":"city"}}

Which looks like this when pretty printed:

{
  "Bio": {
    "male": {
      "name": "trou"
    }
  },
  "place": {
    "live": "city"
  }
}

What the line you quoted from the Filebeat documentation means is that for it to decode JSON you need to have one object per line.

This works:

{"Bio":{"male":{"name":"trou"}},"place":{"live":"city"}}

But this does not work:

{"Bio":{"male":{"name":"trou"}},"place":{"live":"city"}}, {"Bio":{"male":{"name":"trou"}},"place":{"live":"city"}}

In the first one you have one json objects, in the second one you have two json objects separated by a comma.

3

so instead of calling them a JSON object, I should call them object only. correct?