I'm writing an ingest node to parse log lines as I get them from FileBeat. I have an optional json expression inside my log line. If I have this field, I want to parse the json string into an object. Also, I would like to use the on_failure block to set the json parsing error into a "jsonError" field.
The problem is that not all log lines have this field set, and for some reason, the json processor doesn't have the "ignore_missing" option, which is weird to me. I would think it would be a basic functionality for all processors, much like "ignore_failures".
I can use "ignore_failures", but then I wouldn't be able to set the 'jsonError' field on parse errors, as all log files without this field will fail on "field is missing" error.
Any idea how can I achieve this?