# Does the JSON filter create \`null\` value if parsing empty string?

**URL:** <https://discuss.elastic.co/t/does-the-json-filter-create-null-value-if-parsing-empty-string/113801>\
**Category:** Logstash\
**Created:** [January 2, 2018, 3:17pm UTC](https://discuss.elastic.co/t/does-the-json-filter-create-null-value-if-parsing-empty-string/113801 "2018-01-02T15:17:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![arisbanach](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@arisbanach](https://discuss.elastic.co/u/arisbanach)\
**Post date:** [January 2, 2018, 3:17pm UTC](https://discuss.elastic.co/t/does-the-json-filter-create-null-value-if-parsing-empty-string/113801/1 "2018-01-02T15:17:28Z")

</div>

I have been trying to diagnose a couple issues with my Logstash pipeline, but this would explain it if true. If the JSON filter tries to parse a field that is an empty string, it seems like it could be changing the field from `"field_name": ""` to `"field_name": null`.

Can anyone confirm this is how it behaves or is supposed to behave? I would have expected it to just leave it the way it was.

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [January 2, 2018, 4:09pm UTC](https://discuss.elastic.co/t/does-the-json-filter-create-null-value-if-parsing-empty-string/113801/2 "2018-01-02T16:09:45Z")

</div>

LS 6.1.1

```auto
input {
  generator {
    message => '{"fld_1": "01", "fld_2": "", "fld_3": 7}'
    count => 1
  }
}

filter {
  json {
    source => "message"
  }
}

output {
  stdout {
    codec => rubydebug
  }
}

```

event

```auto
{
    "@timestamp" => 2018-01-02T16:08:10.875Z,
       "message" => "{\"fld_1\": \"01\", \"fld_2\": \"\", \"fld_3\": 7}",
      "sequence" => 0,
          "host" => "Elastics-MacBook-Pro.local",
         "fld_1" => "01",
         "fld_3" => 7,
         "fld_2" => "",
      "@version" => "1"
}

```

Same for 5.6.4

---

<div class="post-metadata">

**Author:** ![arisbanach](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@arisbanach](https://discuss.elastic.co/u/arisbanach)\
**Post date:** [January 2, 2018, 4:19pm UTC](https://discuss.elastic.co/t/does-the-json-filter-create-null-value-if-parsing-empty-string/113801/3 "2018-01-02T16:19:27Z")

</div>

Hi, thanks! However, I meant if you had:

```
filter {
  json {
    source => "message"
  }
  json {
    source => "fld_2"
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 30, 2018, 4:19pm UTC](https://discuss.elastic.co/t/does-the-json-filter-create-null-value-if-parsing-empty-string/113801/4 "2018-01-30T16:19:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.