Ingest node - json processor - ignore missing

Elastic Stack Elasticsearch
1

Hi all,

I'm writing an ingest node to parse log lines as I get them from FileBeat. I have an optional json expression inside my log line. If I have this field, I want to parse the json string into an object. Also, I would like to use the on_failure block to set the json parsing error into a "jsonError" field.

The problem is that not all log lines have this field set, and for some reason, the json processor doesn't have the "ignore_missing" option, which is weird to me. I would think it would be a basic functionality for all processors, much like "ignore_failures".

I can use "ignore_failures", but then I wouldn't be able to set the 'jsonError' field on parse errors, as all log files without this field will fail on "field is missing" error.

Any idea how can I achieve this?

Thanks,

Tal

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.