How filebeat handle json string with backslash

(Kimown) #1

Hi, I am using keys_under_root

I know {\"text\":\"message with backslash\"} is not a valid json string, so filebeat treat this message as string, but how can I remove backslash before double quote, does this can be done only in filebeat? should I use logstash?

(Steffen Siering) #2

For this I'd use logstash. Is there a chance of the text being escaped with slashes as well? This looks like escaping gone wrong, trying to repair it can be a little tricky if you have embedded escaped text, which must not de-escaped yet.

(Kimown) #3

I find a solution about the invalid json string, just wrap string as value of json, the key is random, eg: we can use requestBody, so the raw log looks like this: {"requestBody": "{\"text\":\"message with backslash\"}"}. In this case, I have a question, can we treat {\"text\":\"message with backslash\"} as the root because we don't need the outer.

(Kimown) #4

updated: delete duplicate comment

(Steffen Siering) #5

See: decode_json processor docs.

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.