I have been trying to diagnose a couple issues with my Logstash pipeline, but this would explain it if true. If the JSON filter tries to parse a field that is an empty string, it seems like it could be changing the field from
"field_name": "" to
Can anyone confirm this is how it behaves or is supposed to behave? I would have expected it to just leave it the way it was.