# Drop empty message with character NULL \\x00

**URL:** <https://discuss.elastic.co/t/drop-empty-message-with-character-null-x00/224331>\
**Category:** Logstash\
**Created:** [March 20, 2020, 12:51am UTC](https://discuss.elastic.co/t/drop-empty-message-with-character-null-x00/224331 "2020-03-20T00:51:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![quangnguyen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/quangnguyen/32/65567_2.png) [@quangnguyen](https://discuss.elastic.co/u/quangnguyen)\
**Post date:** [March 20, 2020, 12:51am UTC](https://discuss.elastic.co/t/drop-empty-message-with-character-null-x00/224331/1 "2020-03-20T00:51:51Z")

</div>

Hello Community,

i'm getting following log message what makes no sense to forward it in to output. The message contains only null character inside two qoutes "\x00". How could i drop it with logstash filter?

```bash
[2020-03-20T01:08:47,788][ERROR][logstash.inputs.gelf][main] JSON parse failure. Falling back to plain-text {:error=>#<L
ogStash::Json::ParserError: Illegal character ((CTRL-CHAR, code 0)): only regular white space (\r, \n, \t) is allowed between tokens at [Source: (byte[])" "; line: 1, column: 2]>, :data=>"\"\\x00\""}
{
        "message" => "\"\\x00\"",
       "@version" => "1",
     "@timestamp" => 2020-03-20T00:08:47.787Z,
    "source_host" => "192.168.99.104",
           "tags" => [
        [0] "_jsonparsefailure"
    ]
}
{
        "message" => "\"\\x00\"",
       "@version" => "1",
     "@timestamp" => 2020-03-20T00:08:47.788Z,
    "source_host" => "192.168.99.104",
           "tags" => [
        [0] "_jsonparsefailure"
    ]
}

```

I already did following filter but it does not drop the message.

```ruby
    if [message] =~ /^\"[\s]\"$|^\"\"$|^\"\\x00\"$/ {
       drop { }
    }

```

---

<div class="post-metadata">

**Author:** ![calanon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/calanon/32/64004_2.png) [@calanon](https://discuss.elastic.co/u/calanon)\
**Post date:** [March 20, 2020, 5:28pm UTC](https://discuss.elastic.co/t/drop-empty-message-with-character-null-x00/224331/2 "2020-03-20T17:28:33Z")

</div>

You could isolate the field then use mutate to filter it out.

```auto
  mutate { remove_field => ["field1", "field2", "field3", ... "fieldN"] }
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 22, 2020, 6:37pm UTC](https://discuss.elastic.co/t/drop-empty-message-with-character-null-x00/224331/3 "2020-03-22T18:37:43Z")

</div>

If the contents of your string were double quotes followed by NUL followed by double quotes then I would expect rubydebug to show it as

```
   "message" => "\"\u0000\""

```

That said, I can get the json codec to fail to parse with

```
#<LogStash::Json::ParserError: Illegal unquoted character ((CTRL-CHAR, code 0)): has to be escaped using backslash to be included in string value
 at [Source: (String)""""; line: 1, column: 3]>, :data=>"\"\u0000\""}

```

or, if the escape is added,

```
>#<LogStash::Json::ParserError: Unrecognized character escape (CTRL-CHAR, code 0)
 at [Source: (String)""\""; line: 1, column: 4]>, :data=>"\"\\\u0000\""}

```

Does it help you to do this?

```
if "_jsonparsefailure" in [tags] { drop {} }
```

---

<div class="post-metadata">

**Author:** ![quangnguyen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/quangnguyen/32/65567_2.png) [@quangnguyen](https://discuss.elastic.co/u/quangnguyen)\
**Post date:** [March 22, 2020, 9:54pm UTC](https://discuss.elastic.co/t/drop-empty-message-with-character-null-x00/224331/4 "2020-03-22T21:54:30Z")

</div>

@Badger It's not the solution for me. In case of `_jsonparsefailure`, it's ok for me with the fallback to plaintext but i just do want to drop the whole of event if its message contains only "blank" string `"\"\\x00\""`

The following document should not appear in Elasticsearch at end of the day because it does not have added value for me.

```json
{
  "_index": "logstash-2020.03.19-000001",
  "_type": "_doc",
  "_id": "5QQzBHEBr0m51kUUnDVl",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2020-03-22T21:43:43.332Z",
    "message": "\"\\x00\"",
    "@version": "1",
    "source_host": "192.168.99.104",
    "tags": [
      "_jsonparsefailure"
    ]
  },
  "fields": {
    "@timestamp": [
      "2020-03-22T21:43:43.332Z"
    ]
  },
  "sort": [
    1584913423332
  ]
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2020, 9:54pm UTC](https://discuss.elastic.co/t/drop-empty-message-with-character-null-x00/224331/5 "2020-04-19T21:54:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.