[2.1.3] JSON filtering

Elastic Stack Logstash
1

Hi,
I have a situation where log lines are hitting my beats input sent via journalbeat. The input uses the json codec and so expects json.

However, some of the log lines in the client systems journal are plain text. So, i'm thinking to disable the codec on the input and apply the json filter on the message field when the message field from that input is json.

Can you explain to me how I can check that a given message is in fact json before applying the json filter?

Regards,
David

2

I don't know what your plain text messages look like, but if the payload begins with { or {" it probably makes sense to try to parse it as JSON.