Filebeat > logstash "Invalid FieldReference" in the log

seems there are similare topics to this without answer 1
and one suggests there is no solution 2

But I ask anyway maybe somebody can help.
This is the error:

^[[Alogstash    | [2021-11-20T16:57:20,868][INFO ][][main][49528894cc63845bf064fe8ec459595546be7d5bed825120377ffc0e6b836dd2] [local:, remote:] Handling exception: org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference: `/UserAttribute[@ldap:targetAttribute="FullName"]` (caused by: org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference: `/UserAttribute[@ldap:targetAttribute="FullName"]`)
logstash    | [2021-11-20T16:57:20,869][WARN ][][main][49528894cc63845bf064fe8ec459595546be7d5bed825120377ffc0e6b836dd2] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.

as I understand the issue is caused by the '' square brackets, is there anything I can do on the filebeat or logstash side? In logstash i would be happy to even drop these messages if needed or just delete the content of the 'json' field. Or even log them into a file, just to see the full message, whether it appears in the key or value field.

The problem is that filebeats sends all the messages to logstash for a while, and maybe because too much of these exceptions (?) it just stops forwarding messages, I only get these exceptions in the log. After restarting the filebeats service everything again flowing for a short while.

Can you show your config ? did you try to escape [ with \ ?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.