Hi folks. I am using Filebeat to log a bunch of JSON-formatted log-files into ES, and occasionally I get records with a json error such as
Error decoding JSON: invalid character ',' in numeric literal
Can I add the original message field to each document in some way, so I can see what the raw json line was that caused this error? I suspect it's just something not formatted correctly in my log file, but I can't just search for ,
This is currently not possible but I can see that it could be useful to have in the error message as the line that could not be decoded. Could you open a feature request on Github for this?
Maybe you could use the decode_json_fields processor. It does not delete the source field. Then you could use a drop_fields processor to delete the message field when the json_error key is not present. Just a thought, haven't tried it.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.