How filebeat handle json string with backslash

Elastic Stack Beats
1

Hi, I am using keys_under_root

https://www.elastic.co/guide/en/beats/filebeat/5.2/configuration-filebeat-options.html#config-json

I know {\"text\":\"message with backslash\"} is not a valid json string, so filebeat treat this message as string, but how can I remove backslash before double quote, does this can be done only in filebeat? should I use logstash?

2

For this I'd use logstash. Is there a chance of the text being escaped with slashes as well? This looks like escaping gone wrong, trying to repair it can be a little tricky if you have embedded escaped text, which must not de-escaped yet.

3

I find a solution about the invalid json string, just wrap string as value of json, the key is random, eg: we can use requestBody, so the raw log looks like this: {"requestBody": "{\"text\":\"message with backslash\"}"}. In this case, I have a question, can we treat {\"text\":\"message with backslash\"} as the root because we don't need the outer.

https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html#decode-json-example

4

updated: delete duplicate comment

5

See: decode_json processor docs.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.