title: Getting Logstash to treat syslog message string as JSON if applicable
body: <p>I have a variety of shell scripts from which I run a logger line for syslog with a message in json format:</p>
  
  <pre><code>printf '{"task_id": "%s", "seconds": %f, "success": %s}' ${task_id} ${num_seconds} ${success_bool}
  </code></pre>
  
  <p>This gets the following output in /var/log/syslog:</p>
  
  <pre><code>Feb  1 15:12:16 my-machine logger: {"task_id": "231232xyz", "seconds": 12.453000, "success": true}
  </code></pre>
  
  <p>I use the regular logstash syslog input to receive this, and the individual log is received as a regular log, with the message as a string:</p>
  
  <pre><code>"_source": {
      "message": "{\"task_id\": "231232xyz", \"seconds\": 12.453000, \"success\": true}",
      "tags": [
        "_jsonparsefailure",
        "_grokparsefailure"
      ],
  </code></pre>
  
  <p>I could obviously use just a regular message as </p>
  
  <pre><code>task_id: 221232xyz, seconds: 12.453000, success: true
  </code></pre>
  
  <p>and use grok to extract and parse values into fields (including converting the number of seconds to a float), but I feel there should be a solution between using cee or just plain messages that would work best for me. Obviously other messages from Syslog would have a non-json message. Is parsing the contents of the syslog message as JSON feasible?</p>
  
  <p>Edit, per comment's request, here's the logstash input:</p>
  
  <pre><code>input {
      syslog {
          port =&gt; 5000
          host =&gt; "0.0.0.0"
          type =&gt; "syslog"
          codec =&gt; "json"
      }
  }
  </code></pre>
  
  <p>The grok filter was my (working) attempt to match the comma separated message and started extracted the execution time from it:</p>
  
  <pre><code>filter {
      grok {
          match =&gt; ["message", "seconds: %{NUMBER:exec_time}"
      }
      mutate {
         convert =&gt; {"exec_time" =&gt; "float"}
      }
  }
  </code></pre>