topic ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|' in Getting Data In

ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

Juhi28 — Tue, 29 Sep 2020 22:45:52 GMT

Hi,

I am getting below JSOnParser exception in one of my data source [json sourcetype]. Don't think there is any issue with inputs.conf currently in place. Please help?

ERROR JsonLineBreaker - JSON StreamId:7831683518768418639 had parsing error:Unexpected character while parsing backslash escape: '|' - data_source="L:\logs\app\ABC\abc.data.log", data_host="Host001", data_sourcetype="_json"

inputs.conf :-
[monitor://L:\logs\app\ABC\abc.data.log]
sourcetype = _json
index = mydata

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

martin_mueller — Tue, 15 Jan 2019 05:35:56 GMT

It would help if you posted the content in your abc.data.log that caused the parsing error.

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

Juhi28 — Tue, 29 Sep 2020 22:45:57 GMT

Here is a sample data:

{ [-]
ClApp: Applicationname

ClHost: 144.xy.zz.155

ClRealm: Realm
ClUser: juhi28
Env: DEV
ExecMs: 0

ReqEnd: http://juhidev:8700/data/DataManagerService.svc

ReqType: POST

StackTrace:

Status: OK
class: XYZ.Live.DataLive.DataManagerService

host: VMA001NVMM
level: INFO

msg: View request for Random View
tid: CallerFilePath: e:\abc\xcv\wed\qas\int\svn_source\src\PIM\PLMDService\DM.svc.cs; CallerLineNumber: 86; CallerMemberArguments: Viewer,GNGFDwednes
ts: 2019-01-14 21:57:29.24
user: service_account

}

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

martin_mueller — Tue, 15 Jan 2019 09:05:35 GMT

Judging from the [-] and the lack of double quotes I'm guessing that's an event splunk successfully parsed as JSON? A successful event isn't going to tell us what the broken events looked like.

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

Juhi28 — Tue, 15 Jan 2019 09:43:03 GMT

So how should i check which event breaked and resulted in "ERROR JsonLineBreaker - JSON StreamId:7831683518768418639 had parsing error:Unexpected character while parsing backslash escape: '|' -"

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

martin_mueller — Tue, 15 Jan 2019 10:00:26 GMT

You could search the corresponding logfiles that should have been read around that time for a pipe character, for example. You've got the host and path in the message plus its timestamp.

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

Juhi28 — Tue, 15 Jan 2019 10:04:24 GMT

yes the log file is :- L:\logs\app\MMData\PM.Let.Marketjob.DEV.log.

This is the only log which is erring out.

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

nikita_p — Tue, 15 Jan 2019 11:42:46 GMT

Hi,
You should try deploying LINE_BREAKER in props.conf of your indexer
Try:

LINE_BREAKER = "uri":+[^}]+}(,[\r\n]+)
Or:

LINE_BREAKER = }(,[\r\n\s]+){[\r\n\s]+"line":\s1

PFB link in splunk answers and check for the accepted answers and the comments in that. This might help you.
https://answers.splunk.com/answers/700692/splunk-json-parsing-error.html

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

Juhi28 — Tue, 15 Jan 2019 11:52:05 GMT

Hi nikita, how were you able to infer that we should go by this line breaker.

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

nikita_p — Tue, 15 Jan 2019 12:04:42 GMT

As you have mentioned your log format is json, so this regex is for basic json files.
You can also check using INDEXED_EXTRACTIONS = JSON if this regex doesn't work.

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

martin_mueller — Tue, 15 Jan 2019 13:46:24 GMT

Okay... so, what's inside that file? Possibly filtered for "contains pipe char" and "happened around the time of the error"?

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

Juhi28 — Wed, 16 Jan 2019 02:19:54 GMT

@martin , i think i didn't understand your ask. we are already monitoring below logfile. Is it different from what you are asking.

[monitor://L:\logs\app\ABC\abc.data.log]
sourcetype = _json
index = mydata

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

martin_mueller — Wed, 16 Jan 2019 21:37:35 GMT

Somewhere in that file abc.data.log there is a pipe character | that's breaking the JSON parsing. Find it.

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

Juhi28 — Thu, 17 Jan 2019 04:06:50 GMT

Yes correct, found an extra backslash character in the data itself which was breaking json source type.
However it took a lot of time to scan events and judge which event was exactly the culprit.

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

martin_mueller — Thu, 17 Jan 2019 13:21:33 GMT

You've found the culprit? Great 🙂

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

woodcock — Thu, 14 Feb 2019 01:26:21 GMT

You should click Accept to close the question.

Re: ERROR JsonLineBreaker had parsing error:Unexpected character while parsing backslash escape: '|'

OliveT — Wed, 12 Jun 2024 14:35:04 GMT

I had the same problem on a UF, checking the sourcetype props I noticed that there were magic 6 on the agent. After deleting them, the collection works again.