Filebeat output empty JSON array as "null" instead of "[]"

Filebeat output empty JSON array as "null" instead of [ ].

The original line of JSON is as follows, in which "array_field" is an empty array.

{"body": {"array_field": []}}

However, after output, the "array_field" is converted to "null".

2021-06-22T12:30:21.670+0800    INFO    log/harvester.go:302    Harvester started for file: /Users/wangji/example.log

I expected the output should be the same as the original input.

Example configuration YAML:

- type: log
  enabled: true
    - /Users/wangji/example.log
    message_key: json

  codec.format.string: '%{[json.body]}'

The version of filebeat I tried is :

filebeat version 7.13.2 (amd64), libbeat 7.13.2 [686ba416a74193f2e69dcfa2eb142f4364a79307 built 2021-06-10 21:04:13 +0000 UTC]

I am suspecting that this behavior is a bug, which is caused by this line:

When the v.Len() equals 0, this method will return a "nil" instead of an empty interface{} array.
Change the line as follows can fix the anomaly behavior. This change will explicitly initialize the return value as an empty array of interface{} type.

sliceValues := []interface{}{}
1 Like


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.