I have some Proofpoint logs in JSON format likes... { "metadata":{ "tzOffsetMins":-240, "tsEpochMs":1650294078380 }, "ts":"2022-05-17T01:02:10.380410-0400", "guid":"T1sZJIJ-YGTdBDzraMXIw6rea9pB78Qw", "msgParts":[ { "structureId":"0", "metadata":{ "title":"GRAINGER", "viewport":"width=devic…

[image] austin0918: Ruby exception occurred: undefined method each_index' for nil:NilClass Some events do not have a [msgParts] field. Use a conditional in the ruby filter a = event.get("[msgParts]") if a a.each_index { |x| a[x]["metadata"]["extensionless"] = a[x]…

Discuss the Elastic Stack

Handle json filter field name cannot be an empty string error

Elastic Stack Logstash

Badger May 21, 2022, 2:39am 10

If you have a new issue you should generally open a new thread. However, since my entire answer is a link to this, no need to do so.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.