Conditional with chinese character in ingest issue

Elasticsearch 7.12, filebeat get log message then send to elasticsearch.

messages with keyword '上报请求信息' include json data, I created ingest with condition try to get these json data, the following is my ingest content.

{
  "yibo_test_jsondata" : {
    "processors" : [
      {
        "grok" : {
          "field" : "message",
          "patterns" : [
            """^\[(?<timestamp>%{YEAR}:%{MONTHNUM}:%{MONTHDAY} %{TIME})\]\[(?<result.txt>\w+)\](?<reqinfo>[^{]*)%{GREEDYDATA:jsondata}"""
          ]
        }
      },
      {
        "date" : {
          "field" : "timestamp",
          "formats" : [
            "yyyy:MM:dd HH:mm:ss"
          ],
          "timezone" : "UTC+8"
        }
      },
      {
        "json" : {
          "field" : "jsondata",
          "if" : """ctx.reqinfo =~ /上报请求信息/"""
        }
      }
    ]
  }
}

as condition "if" : """ctx.reqinfo =~ /上报请求信息/""" should be analyse message with '上报请求信息'. But without keyword '上报请求信息' (one sample: [2020:01:01 07:37:05][INFO]接口调用失败,参数:{"ParkCode":"510105037","Mac":"6C:4B:90:B4:8F:0F","Random":null,"Sign":null} 返回:{"state":-1103001,"total":0}), still try to analyse and got error "object mapping for [jsondata] tried to parse field [jsondata] as object, but found a concrete value", How can I use chinese in ingest?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.