# Accounting for "field name cannot be an empty string"?

**URL:** <https://discuss.elastic.co/t/accounting-for-field-name-cannot-be-an-empty-string/172423>\
**Category:** Logstash\
**Created:** [March 14, 2019, 9:14pm UTC](https://discuss.elastic.co/t/accounting-for-field-name-cannot-be-an-empty-string/172423 "2019-03-14T21:14:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kenneth\_M\_Kolano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kenneth_m_kolano/32/38752_2.png) [@Kenneth\_M\_Kolano](https://discuss.elastic.co/u/Kenneth_M_Kolano)\
**Post date:** [March 14, 2019, 9:14pm UTC](https://discuss.elastic.co/t/accounting-for-field-name-cannot-be-an-empty-string/172423/1 "2019-03-14T21:14:51Z")

</div>

I have incoming JSON logs with sections like...

```auto
> {"results":{"workers":{"trid": {
	"TRD": [
		{
			"likely": "50.0%",
			"type": "TrID defs package (14009/2/5)"
		}
	],
	"": [
		{
			"likely": "14.2%",
			"type": "Generic RIFF container (4000/1)"
		}
	]
}}}}

```

...which result in Logstash errors...

```auto
Mar 14 00:00:19 pass1 logstash[1929]: [2019-03-14T00:00:19,727][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"file-analysis", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x38a7b5bc>], :response=>{"index"=>{"_index"=>"file-analysis", "_type"=>"doc", "_id"=>"gnZbemkBw5GzxxY5osDe", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"field name cannot be an empty string"}}}}}`

```

I thought I'd be able to just use Mutate/rename to revise them to have a name, but I'm unclear how to specify the blank field name for such...

```auto
rename => { "results.workers.trid.\"\"" => "results.workers.trid.extensionless" }`

```

?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 14, 2019, 9:52pm UTC](https://discuss.elastic.co/t/accounting-for-field-name-cannot-be-an-empty-string/172423/2 "2019-03-14T21:52:10Z")

</div>

If all else fails, try ruby

```
    ruby {
        code => '
            h = event.get("[results][workers][trid]")
            newh = {}
            h.each { |k, v|
                if k == ""
                    newk = "extensionless"
                else
                    newk = k
                end
                newh[newk] = v
            }
            event.set("[results][workers][trid]", newh)
        '
    }

```

Apologies if my ruby coding style makes your eyeballs bleed. (That if-else-end hurts even my eyes!)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 11, 2019, 9:52pm UTC](https://discuss.elastic.co/t/accounting-for-field-name-cannot-be-an-empty-string/172423/3 "2019-04-11T21:52:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.