I have incoming JSON logs with sections like...
> {"results":{"workers":{"trid": {
"TRD": [
{
"likely": "50.0%",
"type": "TrID defs package (14009/2/5)"
}
],
"": [
{
"likely": "14.2%",
"type": "Generic RIFF container (4000/1)"
}
]
}}}}
...which result in Logstash errors...
Mar 14 00:00:19 pass1 logstash[1929]: [2019-03-14T00:00:19,727][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"file-analysis", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x38a7b5bc>], :response=>{"index"=>{"_index"=>"file-analysis", "_type"=>"doc", "_id"=>"gnZbemkBw5GzxxY5osDe", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"field name cannot be an empty string"}}}}}`
I thought I'd be able to just use Mutate/rename to revise them to have a name, but I'm unclear how to specify the blank field name for such...
rename => { "results.workers.trid.\"\"" => "results.workers.trid.extensionless" }`
?