Does the JSON filter create `null` value if parsing empty string?

[arisbanach]

I have been trying to diagnose a couple issues with my Logstash pipeline, but this would explain it if true. If the JSON filter tries to parse a field that is an empty string, it seems like it could be changing the field from "field_name": "" to "field_name": null.

Can anyone confirm this is how it behaves or is supposed to behave? I would have expected it to just leave it the way it was.

[guyboertje]

LS 6.1.1

input {
  generator {
    message => '{"fld_1": "01", "fld_2": "", "fld_3": 7}'
    count => 1
  }
}

filter {
  json {
    source => "message"
  }
}

output {
  stdout {
    codec => rubydebug
  }
}

event

{
    "@timestamp" => 2018-01-02T16:08:10.875Z,
       "message" => "{\"fld_1\": \"01\", \"fld_2\": \"\", \"fld_3\": 7}",
      "sequence" => 0,
          "host" => "Elastics-MacBook-Pro.local",
         "fld_1" => "01",
         "fld_3" => 7,
         "fld_2" => "",
      "@version" => "1"
}

Same for 5.6.4

[arisbanach]

Hi, thanks! However, I meant if you had:

filter {
  json {
    source => "message"
  }
  json {
    source => "fld_2"
  }
}