# Getting mapper\_parsing\_exception error and field name cannot be an empty string in logstash

**URL:** <https://discuss.elastic.co/t/getting-mapper-parsing-exception-error-and-field-name-cannot-be-an-empty-string-in-logstash/380380>\
**Category:** Kibana\
**Created:** [July 23, 2025, 11:47am UTC](https://discuss.elastic.co/t/getting-mapper-parsing-exception-error-and-field-name-cannot-be-an-empty-string-in-logstash/380380 "2025-07-23T11:47:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![upreddy253](https://avatars.discourse-cdn.com/v4/letter/u/d9b06d/32.png) [@upreddy253](https://discuss.elastic.co/u/upreddy253)\
**Post date:** [July 23, 2025, 11:47am UTC](https://discuss.elastic.co/t/getting-mapper-parsing-exception-error-and-field-name-cannot-be-an-empty-string-in-logstash/380380/1 "2025-07-23T11:47:54Z")

</div>

Hi,  
We are trying to onboard new logs into elasticsearch but logs are not indexing into elasticsearch.Logs are apperar in Logstash deadletter queue with "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"field name cannot be an empty string"}}.  
logstash config is  
filter  
{  
grok  
{  
break\_on\_match =\> true  
match =\> {  
"message" =\>  
[  
"%{TIMESTAMP\_ISO8601:timestamp} [%{LOGLEVEL:[@metadata][loglevel]}\s\*] - %{GREEDYDATA:jsonmessage}",  
"%{GREEDYDATA:jsonmessage}"  
]  
}

```
            }
                    json
                    {
                            source => "jsonmessage"
                            target => "[x][data]"
                            tag_on_failure => ["_jsonparsefailure"]
                            skip_on_invalid_json =>true
                    }
					mutate{
					renaming few fileds
					}

```

}

When i did file out in logstash pipeline, In json message **PayMent** filed is available but that PayMent filed is not created as a separate but only value we have that field value ["":"PayMent-00000000002345"].Is it due to any issue with json parser? Or did i miss anything here?  
Could you please guide me on this?

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [July 23, 2025, 11:57am UTC](https://discuss.elastic.co/t/getting-mapper-parsing-exception-error-and-field-name-cannot-be-an-empty-string-in-logstash/380380/2 "2025-07-23T11:57:23Z")

</div>

Welcome to the forum!

> [@upreddy253](#):
>
> after applying json parser the field is not available.

That's likely (part) of your problem!

> [@upreddy253](#):
>
> Could you please guide me on this?

We can try, but you will need to share a couple of sample documents (obfuscate sensitive/private information without changing the structure please), and your logstash configuration.

---

<div class="post-metadata">

**Author:** ![upreddy253](https://avatars.discourse-cdn.com/v4/letter/u/d9b06d/32.png) [@upreddy253](https://discuss.elastic.co/u/upreddy253)\
**Post date:** [July 24, 2025, 4:02am UTC](https://discuss.elastic.co/t/getting-mapper-parsing-exception-error-and-field-name-cannot-be-an-empty-string-in-logstash/380380/3 "2025-07-24T04:02:28Z")

</div>

Hi Kevin,  
Thanks for responding.  
**Sample log:-**  
2025-07-23 05:23:23.846 [INFO] - {"logtype":"abclog","request":{"StreamName":"nonprod-stream","operation":"xyz","sequenceID":"xxxxxxx","type":"ABCDE"},"response":{"SequenceRole":"234446666666666677777777777778888888","PayMent":"PayMent-00000000002345"}}

**Logstash config:-**  
filter  
{  
grok  
{  
break\_on\_match =\> true  
match =\> {  
"message" =\>  
[  
"%{TIMESTAMP\_ISO8601:timestamp} [%{LOGLEVEL:[@metadata][loglevel]}\s\*] - %{GREEDYDATA:jsonmessage}",  
"%{GREEDYDATA:jsonmessage}"  
]  
}

```
            }
                    json
                    {
                            source => "jsonmessage"
                            target => "[x][data]"
                            tag_on_failure => ["_jsonparsefailure"]
                            skip_on_invalid_json =>true
                    }
					mutate{
					renaming few fileds
					}

```

}

When i did file out i am getting below one. In json message PayMent filed is available but after applying json parser the filed name shows empty.  
{"x":{"data":{"response":{},"request":{}}}," **jsonmessage**":"{"logtype":"abclog","request":{"StreamName":"nonprod-stream","operation":"xyz","trackingID":"xxxxxxxx","type":"ABCDE"},"response":{"SequenceRole":"234446666666666677777777777778888888", **"PayMent":"PayMent-00000000002345"** }} ","component":"data-abc","environment":"NONPROD","timestamp":"2025-07-23 10:28:45.279", **"":"PayMent-00000000002345"** ,"logstashhostname":"logstash-abc-0","logtype":"abclog","loglevel":"INFO"}

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [July 24, 2025, 12:37pm UTC](https://discuss.elastic.co/t/getting-mapper-parsing-exception-error-and-field-name-cannot-be-an-empty-string-in-logstash/380380/4 "2025-07-24T12:37:29Z")

</div>

Sorry, I’m not near my computer so can’t test anything, but your data doesn’t quite match the grok pattern, which btw has jsonmessage twice?

Is it always going to include `request:{somestuff}` followed by `response:{otherstuff}`?