seems there are similare topics to this without answer 1
and one suggests there is no solution 2
But I ask anyway maybe somebody can help.
This is the error:
^[[Alogstash | [2021-11-20T16:57:20,868][INFO ][org.logstash.beats.BeatsHandler][main][49528894cc63845bf064fe8ec459595546be7d5bed825120377ffc0e6b836dd2] [local: 172.22.0.11:5044, remote: 139.162.166.68:42394] Handling exception: org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference: `/UserAttribute[@ldap:targetAttribute="FullName"]` (caused by: org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference: `/UserAttribute[@ldap:targetAttribute="FullName"]`)
logstash | [2021-11-20T16:57:20,869][WARN ][io.netty.channel.DefaultChannelPipeline][main][49528894cc63845bf064fe8ec459595546be7d5bed825120377ffc0e6b836dd2] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
as I understand the issue is caused by the '' square brackets, is there anything I can do on the filebeat or logstash side? In logstash i would be happy to even drop these messages if needed or just delete the content of the 'json' field. Or even log them into a file, just to see the full message, whether it appears in the key or value field.
The problem is that filebeats sends all the messages to logstash for a while, and maybe because too much of these exceptions (?) it just stops forwarding messages, I only get these exceptions in the log. After restarting the filebeats service everything again flowing for a short while.