# Logstash parsing error

**URL:** <https://forum.suricata.io/t/logstash-parsing-error/868>\
**Category:** Uncategorized\
**Created:** [December 1, 2020, 3:54pm UTC](https://forum.suricata.io/t/logstash-parsing-error/868 "2020-12-01T15:54:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nuno\_Santos](https://avatars.discourse-cdn.com/v4/letter/n/c68b51/32.png) [@Nuno\_Santos](https://forum.suricata.io/u/Nuno_Santos)\
**Post date:** [December 1, 2020, 3:54pm UTC](https://forum.suricata.io/t/logstash-parsing-error/868/1 "2020-12-01T15:54:32Z")

</div>

Can someone help me with this error?

 ![Screenshot 2020-12-01 at 15.54.14](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/0db97fbb609d695e7fd1c493182e68dfdba6bc8c.jpeg)

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [December 27, 2020, 9:00pm UTC](https://forum.suricata.io/t/logstash-parsing-error/868/2 "2020-12-27T21:00:55Z")

</div>

Can you share more details about your setup and configuration?  
Might be an issue parsing the json output

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [December 27, 2020, 9:26pm UTC](https://forum.suricata.io/t/logstash-parsing-error/868/3 "2020-12-27T21:26:13Z")

</div>

This seems like an issue parsing an HTTP log containing a `content_range` element. Suricata 5.0.x and newer will add a `content_range` object with the following elements (when such a range has been detected):

- `raw`
- `start`
- `end`
- `size`

`raw` is the content range parsed, e.g., `"raw":"bytes 0-384/385"`  
The other members are determined from that so in this case you’d have:  
`"start":0, "end":38,"size":385`

Here’s the JSON object as it would be represented in the HTTP event:  
`"content_range":{"raw":"bytes 0-384/385","start":0,"end":384,"size":385}`