How filebeat handle json string with backslash

Hi, I am using keys_under_root

I know {\"text\":\"message with backslash\"} is not a valid json string, so filebeat treat this message as string, but how can I remove backslash before double quote, does this can be done only in filebeat? should I use logstash?

For this I'd use logstash. Is there a chance of the text being escaped with slashes as well? This looks like escaping gone wrong, trying to repair it can be a little tricky if you have embedded escaped text, which must not de-escaped yet.

I find a solution about the invalid json string, just wrap string as value of json, the key is random, eg: we can use requestBody, so the raw log looks like this: {"requestBody": "{\"text\":\"message with backslash\"}"}. In this case, I have a question, can we treat {\"text\":\"message with backslash\"} as the root because we don't need the outer.

updated: delete duplicate comment

See: decode_json processor docs.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.