# Http filter plugin parse error - Unexpected character ('\\\\\\\\' (code 92)): was expecting double-quote to start field name

**URL:** <https://discuss.elastic.co/t/http-filter-plugin-parse-error-unexpected-character-code-92-was-expecting-double-quote-to-start-field-name/201098>\
**Category:** Logstash\
**Created:** [September 25, 2019, 7:59pm UTC](https://discuss.elastic.co/t/http-filter-plugin-parse-error-unexpected-character-code-92-was-expecting-double-quote-to-start-field-name/201098 "2019-09-25T19:59:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MMH](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mmh/32/54449_2.png) [@MMH](https://discuss.elastic.co/u/MMH)\
**Post date:** [September 25, 2019, 7:59pm UTC](https://discuss.elastic.co/t/http-filter-plugin-parse-error-unexpected-character-code-92-was-expecting-double-quote-to-start-field-name/201098/1 "2019-09-25T19:59:17Z")

</div>

I am using Logstash 6.5 with Elasticsearch 6.5  
What I am trying to achieve is to remove from ELS document fields, that in input has null values.  
Following advice from other thread, I am planning to use `ruby` filter to search for the fields and then `http` filter with `_update` API to remove fields. Code looks like the following:

```auto
filter {
    ruby {
        code => "
        event.set('fields_remove_script', '') 
        event.to_hash.each { |key,value|
            if value == nil
                event.set('fields_remove_script', event.get('fields_remove_script') + 'ctx._source.remove(\'' + key + '\');')
                event.remove(key)
            end
        }
        "
    }
    
    if [fields_remove_script] != '' { 
        http {
            url => "https://localhost:9200/test_idx/_update/%{[elastic_id]}"
            verb => "POST"
            user => "elastic"
            password => "changeme"
            cacert => '/logstash/certs/ca.crt'
            body_format => "json"
            body => "{\"script\" : \"%{[fields_remove_script]}\"}"
        }
    }
}

```

and creates the following error:

> [ERROR] 2019-09-25 19:23:02.688 [Ruby-0-Thread-7: :1] http - error during HTTP request {:url=\>"[https://localhost:9200/test\_idx/\_update/id1](https://localhost:9200/test_idx/_update/id1)", :code=\>400, :response=\>"{"error":{"root\_cause":[{"type":"mapper\_parsing\_exception","reason":"failed to parse"}],"type":"mapper\_parsing\_exception","reason":"failed to parse","caused\_by":{"type":"i\_o\_exception","reason":"Unexpected character ('\\' (code 92)): was expecting double-quote to start field name\n at [Source: org.elasticsearch.common.bytes.BytesReference$MarkSupportingStreamInputWrapper@71f72bb3; line: 1, column: 3]"}},"status":400}"}

So basically parse error because of `Unexpected character ('\\' (code 92)): was expecting double-quote to start field name`.  
Any ideas about how to make it work?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 26, 2019, 4:00pm UTC](https://discuss.elastic.co/t/http-filter-plugin-parse-error-unexpected-character-code-92-was-expecting-double-quote-to-start-field-name/201098/2 "2019-09-26T16:00:18Z")

</div>

> [@MMH](#):
>
> ```
> body => "{\"script\" : \"%{[fields_remove_script]}\"}"
> 
> ```

If you try

```
mutate { add_field => { "body" => "{\"script\" : \"%{[fields_remove_script]}\"}" } }

```

you will see the problem. This results in

```
"body" => "{\\\"script\\\" : \\\"ctx._source.remove('bar');ctx._source.remove('foo');\\\"}",

```

I suggest

```
"body" => '{"script" : "%{[fields_remove_script]}"}'

```

which results in

"body" =\> "{"script" : "ctx.\_source.remove('bar');ctx.\_source.remove('foo');"}",

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2019, 4:00pm UTC](https://discuss.elastic.co/t/http-filter-plugin-parse-error-unexpected-character-code-92-was-expecting-double-quote-to-start-field-name/201098/3 "2019-10-24T16:00:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.