logstash - json filter fails with >#<NoMethodError: undefined method `[]' for nil:NilClass> -

i'm trying process entries logfile contains both plain messages , json formatted messages. initial idea grep messages enclosed in curly braces , have them processed chained filter. grep works fine (as plain message processing), subsequent json filter reports exception. attached logstash configuration, input , error message below.

do have ideas problem might be? alternative suggestions processing plain , json formatted entries same file?

thanks lot, johannes

error message:

trouble parsing json {:key=>"@message", :raw=>"{\"time\":\"14.08.2013 10:16:31:799\",\"level\":\"debug\",\"thread\":\"main\",\"clazz\":\"org.springframework.beans.factory.support.defaultlistablebeanfactory\",\"line\":\"214\",\"msg\":\"returning cached instance of singleton bean 'org.apache.activemq.xbean.xbeanbrokerservice#0'\"}", :exception=>#<nomethoderror: undefined method `[]' nil:nilclass>, :level=>:warn} 

logstash conf:

file {         path => [ "plain.log" ]          type => "plainlog"          format => "plain"      } } filter {   # grep json formatted messages , send them following json filter   grep {     type => "plainlog"     add_tag => [ "grepped_json" ]     match => [ "@message", "^{.*}" ]   }   json {     tags => [ "grepped_json" ]     source => "@message"   } } output {    stdout { debug => true debug_format => "json"}   elasticsearch { embedded => true } } 

input logfile (just 1 line):

{"time":"14.08.2013 10:16:31:799","level":"debug","thread":"main","clazz":"org.springframework.beans.factory.support.defaultlistablebeanfactory","line":"214","msg":"returning cached instance of singleton bean 'org.apache.activemq.xbean.xbeanbrokerservice#0'"} 

i had same problem , solved adding target json filter. documentation target optional apparently isn't.

changing example should have:

json {   tags => [ "grepped_json" ]   source => "@message"   target => "data" }