I have some Proofpoint logs in JSON format likes... { "metadata":{ "tzOffsetMins":-240, "tsEpochMs":1650294078380 }, "ts":"2022-05-17T01:02:10.380410-0400", "guid":"T1sZJIJ-YGTdBDzraMXIw6rea9pB78Qw", "msgParts":[ { "structureId":"0", "metadata":{ "title":"GRAINGER", "viewport":"width=devic…

[image] austin0918: Ruby exception occurred: undefined method each_index' for nil:NilClass Some events do not have a [msgParts] field. Use a conditional in the ruby filter a = event.get("[msgParts]") if a a.each_index { |x| a[x]["metadata"]["extensionless"] = a[x]…

Handle json filter field name cannot be an empty string error

Elastic Stack Logstash

Badger May 21, 2022, 2:39am 10

If you have a new issue you should generally open a new thread. However, since my entire answer is a link to this, no need to do so.

Topic		Replies	Views
Accounting for "field name cannot be an empty string"? Logstash	2	2556	April 11, 2019
The JSON filter can extract empty field names, which are then unusable by Logstash Logstash	1	351	May 31, 2021
Handling a JSON key with a name being an empty string "" Logstash	1	766	November 10, 2022
Does the JSON filter create `null` value if parsing empty string? Logstash	3	2707	January 30, 2018
Json field check filter Logstash	3	2266	March 6, 2019

Handle json filter field name cannot be an empty string error

Related topics