title: Logstash - JSON parse list
body: <p>I'm really liking ELK for parsing the logs. However, I'm stuck at a point where it needs to parse a list of dictionaries. Following are my logs:-</p>
  
  <pre><code>IP - - 0.000 0.000 [24/May/2015:06:51:13 +0000] *"POST /c.gif HTTP/1.1"* 200 4 * user_id=UserID&amp;package_name=SomePackageName&amp;model=Titanium+S202&amp;country_code=in&amp;android_id=AndroidID&amp;eT=1432450271859&amp;eTz=GMT%2B05%3A30&amp;events=%5B%7B%22eV%22%3A%22com.olx.southasia%22%2C%22eC%22%3A%22appUpdate%22%2C%22eA%22%3A%22app_activated%22%2C%22eTz%22%3A%22GMT%2B05%3A30%22%2C%22eT%22%3A%221432386324909%22%2C%22eL%22%3A%22packageName%22%7D%5D * "-" "-" "-"
  </code></pre>
  
  <p>The URL decoded version of the above log is </p>
  
  <pre><code>IP - - 0.000 0.000 [24/May/2015:06:51:13  0000] *"POST /c.gif HTTP/1.1"* 200 4 * user_id=UserID&amp;package_name=SomePackageName&amp;model=Titanium S202&amp;country_code=in&amp;android_id=AndroidID&amp;eT=1432450271859&amp;eTz=GMT+05:30&amp;events=[{"eV":"com.olx.southasia","eC":"appUpdate","eA":"app_activated","eTz":"GMT+05:30","eT":"1432386324909","eL":"packageName"}] * "-" "-" "-"
  </code></pre>
  
  <p>Wherever I try to parse it, it shows me <code>_jsonparsefailure</code>. I've gone through <a href="https://stackoverflow.com/questions/28753921/logstash-does-not-parse-json">this</a> question as well, and has gone through various forums as well, but didnt find a perfect solution for the same. How can I parse a json list in logstash?? If there <strong>doesnt exist</strong> any till now, what can be the work around for the same.??</p>
  
  <p>Following is my config file.</p>
  
  <pre><code>filter {
      mutate {
          gsub =&gt; [
              "message", "\+", "%20"
          ]
      }
  
      urldecode{
          field =&gt; "message"
      }
      grok {
          match =&gt; [
              'message', '%{IP:clientip}%{GREEDYDATA} \[%{GREEDYDATA:timestamp}\] \*"%{WORD:method}%{GREEDYDATA}'
          ]
      }
  
      kv {
          field_split =&gt; "&amp;?"
      }
  
      json{
          source =&gt; "events"
      }
  
      geoip {
          source =&gt; "clientip"
      }
  }
  </code></pre>